Skip to content
Malware

Fake APK Install Scam

Scammers send APK files or links that pretend to be bank, courier, KYC, government, loan, or support apps. Installing them can expose SMS, notifications, accessibility controls, and financial apps.

Common script

What the message or call may sound like

Install this customer support app to complete refund/KYC. Allow all permissions for verification.
Mechanism

Why this scam works

The scam presents installation as the only way to finish a refund, job, loan, KYC, or support process.

Red flags

Stop when you see these signals

  • APK sent through WhatsApp, SMS, Telegram, or a random website
  • Request to enable unknown sources
  • Accessibility, notification, SMS, screen overlay, or device admin permissions
  • Banking, courier, loan, KYC, or government branding
  • Caller guides you through installation
Do now

If this is happening to you

  1. Disconnect from the call or chat.
  2. Uninstall the app if possible.
  3. Use a trusted device to change important passwords.
  4. Call the bank if financial apps or OTPs may be exposed.
  5. Consider professional device cleanup if permissions were granted.
Do not
  • Do not grant accessibility or SMS permissions to unknown apps.
  • Do not enter banking passwords after installing suspicious APKs.
  • Do not assume deleting the chat removes the app.
Save evidence
  • APK name and link
  • Installer screenshot
  • Permission screen
  • Caller number and chat messages
Prevent repeat risk
  • Install apps only from official app stores or typed official websites.
  • Keep unknown sources disabled.
  • Review installed apps and permissions regularly.
Run a check

Use Kaval on this pattern

Answers

Common questions

Is every APK unsafe?

No, but APKs sent by strangers, support agents, bank warnings, courier messages, or job offers should be treated as dangerous.

What if I already installed it?

Stop using sensitive apps on that device, remove the app if possible, secure accounts from another trusted device, and contact your bank if financial access was exposed.

Guides