The message comes from an unknown number, or sometimes from a friend's number whose account has been taken over. It's short: "Here's our wedding invitation", "Your parcel is on hold, check the receipt", or "Your vehicle tax bill". What's attached isn't an image or PDF, but a file ending in .apk.

That file is an app. While it's only received, it does nothing. The danger starts the moment it's installed.

The most common forms

Names and stories change with the season, but the pattern is almost always one of these:

  • Wedding or event invitations. Playing on curiosity: who's getting married?
  • Courier receipts or parcel photos. Effective because nearly everyone is waiting for a delivery.
  • Bills, traffic fines, or tax notices. Playing on fear and urgency.
  • Bank notices, such as a transfer fee change that must be approved.
  • Job offers or prize draws, complete with a "registration app".

One thing unites them all: real documents are never sent as apps. Invitations are images or PDFs, receipts are numbers checked on the courier's site, and official bills don't arrive as files to install.

What it can do once installed

These apps almost always ask for permissions straight away. The three most dangerous:

  • Reading SMS and notifications. OTP codes from banks and digital wallets are read and forwarded to the scammer within seconds. This is how accounts get drained even though the password was never given.
  • Accessibility. A feature built to help people with disabilities. In a scammer's hands, it lets the app read the screen and tap buttons itself, as if the owner were doing it.
  • Display over other apps. Used to cover the screen with a fake view, such as "system updating", while transactions run behind it.

Many of these apps also hide their icon after installation, so the owner thinks nothing happened. The same code-theft pattern is explained in two-factor authentication and account security: a code is for entering, and an app that can read it is as dangerous as a person asking for it.

How to recognise it before it's too late

  • Look at the file type. WhatsApp shows it. If it says APK, stop there, whatever the title.
  • An "install unknown apps" prompt. If the phone asks permission to install apps from WhatsApp or a file manager, that's the clearest sign. Documents never ask for this.
  • An unknown number, or an unusual tone from a known one. If in doubt, ask by phone call, not in the same chat.
  • Time pressure. "Urgent", "last day today", "the parcel will be returned". Scams are always in a hurry, because a moment's thought is enough to stop them.

Settings that prevent it

A few Android settings close most of the routes:

  1. Turn off "install unknown apps" for WhatsApp, the browser, and the file manager. It's usually in Settings, Apps, Special app access. Turn it on only when truly needed, then off again.
  2. Make sure Google Play Protect is on. It checks apps installed from outside the Play Store and often blocks known malicious ones.
  3. Turn off WhatsApp auto-download for documents, so files don't pile up unnoticed.
  4. Update the operating system. Newer Android versions restrict accessibility permission for apps from outside the official store.

For older family members, these settings are best prepared once by someone else and left alone. The approach is covered in setting up Wi-Fi for elderly parents.

If it's already installed

Order matters. The first step is cutting its way out, not hunting for the app:

  1. Turn off mobile data and Wi-Fi, or switch on airplane mode. This stops captured codes being sent.
  2. Call the bank on the official number on your card or the bank's website, from another phone. Ask for mobile banking and cards to be temporarily blocked.
  3. Remove the app. Look in Settings, Apps, including anything with an unfamiliar name or no icon. If it can't be removed, revoke its accessibility and device admin permissions first.
  4. Change passwords for important accounts from another device, starting with your main email.
  5. If unsure the phone is clean, back up photos and contacts, then factory reset. Cleaning a phone is covered in safely selling or disposing of an old phone.

Tell your contacts too. A compromised WhatsApp account is often used to send the same file to the whole contact list, and a message from a known number is far easier to trust.

Reporting

The sender's number can be reported directly in WhatsApp through report and block. If money was lost, keep screenshots of the chat, the sender's number, and transaction proof before deleting anything, then report to the bank and the police. If personal data leaked, the steps are in reporting a personal data breach.

The pattern matches other scams that rely on trust and urgency, such as fake internet technician scams and Wi-Fi QR code scams. Only the door is different.

Frequently asked questions

Is opening the chat or downloading the APK already dangerous?

Usually not. An APK doesn't run just because it was received or downloaded. The danger starts when it's installed and given permissions. Still, delete the file and the chat, because someone else using the same phone might install it.

How can a fake app take money from a bank account?

It asks for permission to read SMS and notifications, so OTP codes from the bank are read and forwarded to the scammer. Some also use accessibility permission to tap buttons on screen as if the owner were doing it.

Are iPhones affected by this scam?

APK files only install on Android, so iPhones aren't affected by this form. But the same message often just switches to a link to a fake page, and that's dangerous on any phone.