Fake traffic challan, wedding card and "bank" APK files

A challan, an invitation or a bill is a picture or a PDF. A file ending in .apk is an app, and no genuine notice is ever an app.

How it works

A message arrives, often from a number you know whose phone is already infected:

• "Traffic challan issued against your vehicle. Download to view: RTO Challan.apk"
• "You are invited to our wedding. Wedding invitation.apk"
• "Your bank reward points expire today: Rewards.apk"
• "PM Kisan update", "electricity bill", "courier slip", "Aadhaar update".

The file is an Android app. When you tap it, the phone warns that it is from an unknown source. If you allow the install, the app asks for permission to read and send SMS, to read notifications and contacts, and sometimes for accessibility control. It then hides its icon.

From that moment it forwards every OTP and bank alert to the fraudster, who uses your card or logs in to your accounts, and it sends the same file from your WhatsApp or SMS to all your contacts.

The signs

• The file name ends in .apk. A document ends in .pdf, a picture in .jpg or .png.
• WhatsApp shows it as a file to install, not as a preview.
• The phone asks you to allow installing unknown apps.
• A challan message that does not come from the official sender, or that asks you to install anything. Traffic challans can be checked on the government's official e-challan website by entering your vehicle or challan number yourself.
• The message is forwarded or sent to many people at once.

iPhones cannot install .apk files, but the same messages may carry links to fake payment pages, so the caution about links applies to everyone.

If you only received it

Do not open it. Delete the message. Tell the sender that their phone may be infected, by calling them, not by replying.

If you installed it

1. Turn on flight mode.
2. From another phone, call your bank's official helpline: block cards, UPI and net banking. Dial 1930 if money has moved.
3. On the infected phone open Settings › Apps › See all apps and look for recently installed or unfamiliar apps, including ones with blank names or icons. Uninstall them. If the Uninstall button is greyed out, first remove the app's rights under Settings › Security › Device admin apps and Settings › Accessibility.
4. Run a scan with Play Protect: Play Store › profile picture › Play Protect › Scan.
5. Check Messages settings: the default SMS app should be your normal one.
6. The surest cure is a factory reset after backing up photos. Set the phone up fresh; do not restore apps from an unknown source.
7. From a clean device, change the passwords of email, banking and social accounts, and in WhatsApp check Linked devices and log out any you do not recognise.
8. Warn your contacts that a file sent from your number should not be opened.

Prevention

• Keep Install unknown apps off for WhatsApp, your browser and file manager. See Android privacy settings.
• Install apps only from the Play Store, and leave Play Protect on.
• Turn off automatic media download in WhatsApp for documents.

If money has already gone

1. Dial 1930 at once. It is the national helpline for victims of financial cyber fraud. Give the transaction details; the earlier the report, the better the chance that the money can be held before it is moved on.
2. Call your bank or card company on its official number and block the card, UPI or account. Report the transaction as unauthorised and note the complaint number.
3. File the complaint on the National Cyber Crime Reporting Portal, cybercrime.gov.in, and keep the acknowledgement number.
4. Keep everything: screenshots, numbers, UPI IDs, account numbers, transaction references, links, the app's name. Do not delete chats.

The full checklist, with what to keep ready, is on what to do after a fraud. Helpline and portal checked on 12 November 2026.

Independent guide. This is not a government, bank or police website. Helplines and rules were checked at official sources on 12 November 2026; confirm on the official site before relying on them.