Verified by BharatSecure.app Sources: Reserve Bank of India, Press Information Bureau, Ministry of Home Affairs, All India Radio (Prasar Bharati)

APK-based OTP Fraud

एपीके-आधारित ओटीपी धोखाधड़ी

INDIA — By BharatSecure Threat Intelligence Team ·

Dangerous Risk: 10/10 Severity: Critical BharatSecure Threat Intelligence

Category: Bank

Evidence & AI transparency

Sources checked. This type of scam is documented by Reserve Bank of India, Press Information Bureau, Ministry of Home Affairs, All India Radio (Prasar Bharati). That does not independently verify every detail on this page.

This page includes AI-assisted analysis. AI assistance does not mean a person reviewed or approved this page.

Sources: 3 · Last automated validation: Not recorded

Evidence-backed facts: statements mapped to cited evidence by the automated validator. BharatSecure analysis: interpretation and safety guidance; it is not an official finding.

Automated analysis can contain errors. Confirm important information and decisions with official authorities.

Report an error or suggest a correction

Verdict Summary

APK-based OTP Fraud is a confirmed scam. Do not engage — block the sender and report to 1930 (National Cyber Crime Helpline) immediately.

Risk score: 10/10 · Severity: Critical · Verdict: Dangerous

Scam Intelligence: APK-based OTP Fraud

Proprietary signals from BharatSecure's scam-tracking database.

Last reportedApr 11, 2026
First documentedApr 11, 2026

How APK-based OTP Fraud Works

  1. User is tricked into installing a malicious Android APK via a link or social engineering
  2. The app requests permissions to read and send SMS messages
  3. Malware silently intercepts incoming banking OTPs and forwards them to overseas C2 servers
  4. Fraudsters use the OTPs to authorize unauthorized transactions or account takeovers

How This Scam Works — Detailed Explanation

APK-based OTP Fraud is a recent and critical threat targeting Indian mobile banking and UPI users. Scammers create fake Android apps, often disguised as parcel delivery services, banking tools, or utility apps, and trick users into downloading these APK files outside the official Google Play Store. Once installed, these malicious apps can read and intercept SMS messages that contain one-time passwords (OTPs) sent by banks or UPI apps like Google Pay, PhonePe, or Paytm. Because the app has access to your OTPs, scammers can approve transactions, transfer money, or link your Aadhaar and bank accounts without your knowledge.

The fraudsters typically send urgent messages via WhatsApp, SMS, or even calls, warning users of a blocked bank account, failed parcel delivery, or suspicious activity that requires immediate attention. These messages contain links to download the fake app, which often requests unnecessary permissions such as reading and writing SMS. Indian users, worried by the urgent tone, often comply without checking the source. Once the app is installed and permissions granted, the fraud begins unnoticed.

Once scammers have access to your OTPs, they can bypass two-factor authentication used by banks, mobile wallets, and UPI platforms. This allows them to complete fraudulent transactions directly from your bank account or wallet. Victims may notice money disappearing, or new loans being taken out in their name. Because these apps operate silently in the background, users rarely realize they have been targeted until financial losses occur.

This scam leverages India’s extensive use of mobile banking and UPI payments combined with increasing reliance on instant OTP verification. Fraudsters exploit the trust users have in apps and their urgency to act quickly. Without awareness, users fall victim by downloading apps from unknown sources and handing over control of sensitive security information. Understanding how this scam operates is crucial to protect your money and personal data in today’s digital India.

Who Does APK-based OTP Fraud Target?

Digital payment users, banking customers, and online shoppers in India

Red Flags — How to Identify APK-based OTP Fraud

  • Request to download apps outside the Google Play Store
  • Apps requesting SMS read/write permissions unnecessarily
  • Urgent messages regarding parcel deliveries or bank account blocks

What To Do If You Encounter APK-based OTP Fraud

  1. Delete any suspicious apps downloaded outside the Google Play Store immediately.
  2. Check your bank and UPI app transaction history for unauthorized payments or changes.
  3. Change your banking and UPI PINs and passwords as soon as possible.
  4. Inform your bank or mobile wallet provider about any suspicious activity.
  5. Report the incident to cybercrime authorities or use the BharatSecure platform for guidance.

How to Report APK-based OTP Fraud in India

  • Call 1930 — National Cyber Crime Helpline (24x7)
  • File a complaint at cybercrime.gov.in
  • Contact your bank immediately if money was lost
  • Call RBI helpline: 14440 for banking fraud

Frequently Asked Questions

What is APK-based OTP Fraud?
APK-based OTP Fraud is a reported bank scam that BharatSecure has documented as affecting Indian users. Fraudsters use it to trick victims into sharing money, OTPs, or personal and banking details. It currently carries a risk rating of 10/10 (Critical).
Is APK-based OTP Fraud dangerous, and how common is it in India?
Yes. This scam is rated Critical severity (10/10) because it can lead to direct financial loss or identity theft. It spreads through SMS, WhatsApp, phone calls, and fake websites, and variants are reported across India throughout the year. Treat any unexpected message or call matching this pattern as suspicious until verified.
How can I protect myself from APK-based OTP Fraud?
Delete any suspicious apps downloaded outside the Google Play Store immediately. Check your bank and UPI app transaction history for unauthorized payments or changes. Change your banking and UPI PINs and passwords as soon as possible. Inform your bank or mobile wallet provider about any suspicious activity. Never share OTPs, UPI PINs, card numbers, or passwords; verify any request independently using official numbers from the company's real website; and avoid clicking links in unsolicited messages.
How do I report APK-based OTP Fraud in India?
Call 1930 (the National Cyber Crime Helpline) within 24 hours for the best chance of recovering funds, and file a complaint at cybercrime.gov.in with screenshots and transaction details. Notify your bank's fraud team to freeze transactions, and report the suspect UPI ID or phone number to BharatSecure so other users can be warned.

Status: Verified by BharatSecure.app

This type of scam is documented by the credible published sources listed below. That does not independently verify every detail on this page.

Official guidance on this type of scam

These sources document this kind of scam in general. They are not evidence about the specific details, names or numbers on this page.

References

Page-specific source research is pending.

Full guide: Fake KYC update messages and OTP/UPI PIN theft - what this type of scam is, warning signs and where to report it.

Related Scams in India

Verify Any Suspicious Message

Check any suspicious message, link, or call at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.