APK-Based OTP Interception Fraud
एपीके-आधारित ओटीपी चोरी धोखाधड़ी
INDIA — By BharatSecure Threat Intelligence Team ·
Category: Bank
Verdict Summary
APK-Based OTP Interception Fraud is a confirmed scam. Do not engage — block the sender and report to 1930 (National Cyber Crime Helpline) immediately.
Risk score: 10/10 · Severity: Critical · Verdict: Dangerous
Scam Intelligence: APK-Based OTP Interception Fraud
Proprietary signals from BharatSecure's scam-tracking database.
| Last reported | Apr 09, 2026 |
| First documented | Apr 09, 2026 |
How APK-Based OTP Interception Fraud Works
- Fraudsters send malicious APK files via WhatsApp, SMS, or Email disguised as legitimate banking or government apps.
- User installs the app and grants permissions for SMS, notifications, and accessibility services.
- The malware intercepts banking OTPs in real-time and forwards them to foreign command-and-control servers.
- Fraudsters use the intercepted OTPs to drain bank accounts or wallets via instant payment systems.
How This Scam Works — Detailed Explanation
APK-Based OTP Interception Fraud is a highly dangerous scam targeting Indian mobile banking and UPI users. Scammers create fake Android application packages (APKs) that look like legitimate apps but contain hidden malware designed to steal OTPs (One-Time Passwords). These malicious APK files are often shared through WhatsApp messages, SMS links, or even fraudulent websites, tricking users into downloading and installing the app outside of the official Google Play Store. Since many Indians prefer using trusted sources for app downloads, receiving a prompt to install via unfamiliar channels raises a critical red flag.
Once installed, these malicious APKs request extensive permissions, especially 'Accessibility Service' rights and permission to read and manage SMS or notifications. Accessibility Service access allows the app to capture screen activity and interact with other apps, making it possible to intercept OTP messages sent by banks or UPI apps like BHIM or Google Pay. The malware can silently read the SMS OTPs or notifications, relay them to the scammer, and enable unauthorized transactions from the victim's bank account without their knowledge.
Scammers often approach victims by sending fake messages claiming to be bank alerts, UPI transaction failures, or account suspension warnings. They create a sense of urgency, prompting users to install the app to 'resolve the issue.' Once installed, the malware activates in the background, waiting for OTPs related to mobile banking, Aadhaar-linked services, or UPI payments. Victims notice transactions happening without their approval or receive alerts about money debits after some delay, making real-time detection difficult.
Once scammers obtain the OTP, they can quickly authorize fund transfers through mobile banking apps or UPI platforms. This results in money being drained from victims' bank accounts rapidly. Victims may experience significant financial loss and face challenges recovering their money. The scam also compromises personal information linked to Aadhaar or bank accounts, making it easier for fraudsters to carry out identity theft and further malicious activities.
Who Does APK-Based OTP Interception Fraud Target?
Android users in India using mobile banking and instant payment apps
Red Flags — How to Identify APK-Based OTP Interception Fraud
- Request for APK installation outside of Google Play Store
- App requesting 'Accessibility Service' permissions
- App requesting permission to read and manage SMS/Notifications
What To Do If You Encounter APK-Based OTP Interception Fraud
- Do not install APK files from sources other than the official Google Play Store.
- Immediately uninstall any app that asks for Accessibility Service or SMS reading permissions without a clear reason.
- Call your bank’s customer care or report the fraud to your bank if you notice unauthorized transactions.
- File a complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in if you suspect APK malware.
- Change your UPI PIN and mobile banking passwords as soon as you detect suspicious activity.
How to Report APK-Based OTP Interception Fraud in India
- Call 1930 — National Cyber Crime Helpline (24x7)
- File a complaint at cybercrime.gov.in
- Contact your bank immediately if money was lost
- Call RBI helpline: 14440 for banking fraud
Frequently Asked Questions
- What is APK-Based OTP Interception Fraud?
- APK-Based OTP Interception Fraud is a reported bank scam that BharatSecure has documented as affecting Indian users. Fraudsters use it to trick victims into sharing money, OTPs, or personal and banking details. It currently carries a risk rating of 10/10 (Critical).
- Is APK-Based OTP Interception Fraud dangerous, and how common is it in India?
- Yes. This scam is rated Critical severity (10/10) because it can lead to direct financial loss or identity theft. It spreads through SMS, WhatsApp, phone calls, and fake websites, and variants are reported across India throughout the year. Treat any unexpected message or call matching this pattern as suspicious until verified.
- How can I protect myself from APK-Based OTP Interception Fraud?
- Do not install APK files from sources other than the official Google Play Store. Immediately uninstall any app that asks for Accessibility Service or SMS reading permissions without a clear reason. Call your bank’s customer care or report the fraud to your bank if you notice unauthorized transactions. File a complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in if you suspect APK malware. Never share OTPs, UPI PINs, card numbers, or passwords; verify any request independently using official numbers from the company's real website; and avoid clicking links in unsolicited messages.
- How do I report APK-Based OTP Interception Fraud in India?
- Call 1930 (the National Cyber Crime Helpline) within 24 hours for the best chance of recovering funds, and file a complaint at cybercrime.gov.in with screenshots and transaction details. Notify your bank's fraud team to freeze transactions, and report the suspect UPI ID or phone number to BharatSecure so other users can be warned.
Related Scams in India
Verify Any Suspicious Message
Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.