An APK scam uses a fake Android app file sent via WhatsApp or SMS. Once installed, the app can steal OTPs and banking information, which scammers then use to withdraw money from the victim's account.

I opened an APK wedding invite but did not install it. Am I safe?

Downloading the file alone usually does not install it. Delete the file and do not open it. If you pressed install or granted any permissions, disconnect from the internet and contact your bank immediately as a precaution.

Money disappeared after I installed an APK. Can I get it back?

There is no guarantee. Call 997 and your bank immediately so transactions can be blocked or funds frozen if there is still time. An early report gives the best chance, so do not wait.

Can iPhone users be hit by APK scams?

APK files are for Android and cannot be installed directly on an iPhone. However, iPhone users can still be tricked by fake website links that ask for banking details, so stay careful with links in messages.

Guide

APK scams: fake app files sent on WhatsApp

An APK scam is a fraud where an Android app file (.apk) is sent through WhatsApp or SMS disguised as a wedding invitation, a house cleaning booking app, a parcel tracker or a government form. Once installed, the app can read your SMS, including banking OTPs, and take control of your phone. Never install APK files from messages; only download apps from official app stores.

How to report a scam →

Already transferred money? Call 997 (NSRC) now — 24 hours. How to report a scam →

Common APK lures

A digital wedding invitation from an unknown number.
A booking app for house cleaning, aircon servicing or food at a promotional price.
A parcel tracking or delivery payment app.
A file claiming to be from a government agency, bank or utility company.

What a malicious app can do

Read incoming SMS, including OTP and TAC codes.
Ask for accessibility permissions to control your screen.
Steal your online banking username and password.
Send itself to your contacts through WhatsApp.

What to do right away if it is installed

Turn off your phone's internet (mobile data and Wi-Fi) immediately.
Call your bank to block your account and cards.
Call 997 (NSRC) if money has left your account.
Use another, safe device to change your banking and email passwords.
Get technical help to remove the app or reset the phone.

How to avoid it

Turn off the setting that allows installing apps from unknown sources. If you receive an invitation or document from a known contact that seems odd, call that person first to ask. A friend's WhatsApp account can be hijacked too.

Frequently asked questions

What is an APK scam?: An APK scam uses a fake Android app file sent via WhatsApp or SMS. Once installed, the app can steal OTPs and banking information, which scammers then use to withdraw money from the victim's account.
I opened an APK wedding invite but did not install it. Am I safe?: Downloading the file alone usually does not install it. Delete the file and do not open it. If you pressed install or granted any permissions, disconnect from the internet and contact your bank immediately as a precaution.
Money disappeared after I installed an APK. Can I get it back?: There is no guarantee. Call 997 and your bank immediately so transactions can be blocked or funds frozen if there is still time. An early report gives the best chance, so do not wait.
Can iPhone users be hit by APK scams?: APK files are for Android and cannot be installed directly on an iPhone. However, iPhone users can still be tricked by fake website links that ask for banking details, so stay careful with links in messages.

Short guides to the scam tactics common in Malaysia, how to check bank accounts, phone numbers and licences, and what to do right away if you have been hit.