Fraud Anatomy
Fake APK malware
and banking fraud
A fake APK is a malicious Android app file shared as a bill update, challan or bank app. Once installed it can read messages, capture one-time passwords and act on the phone, so the banking app is then used on a device the attacker already controls.
What is a fake APK scam?
Fraudsters send a message that looks routine: a gas or electricity bill update, a traffic challan, a KYC notice or a new version of a bank app. The message carries an APK file, the Android installation package, instead of a link to the Play Store. Because the file is installed from outside the store, the victim has to allow installation from unknown sources and then accept a list of permissions.
Those permissions are the real attack. Access to SMS lets the malware read one-time passwords. Accessibility access lets it read the screen and tap buttons. The permission to draw over other apps lets it place a fake login screen on top of the real banking app. Some of these files also forward themselves to the victim's WhatsApp and Telegram contacts, so each infection spreads the next.
A 2026 case in Ahmedabad
In June 2026 Ahmedabad Cyber Crime arrested a Jharkhand-based gang behind a pan-India fake-APK racket. A victim received a WhatsApp message saying his gas connection would be cut unless he updated his bill details. He installed a file called "Sabarmati Gas Bill Update.apk" and lost ₹6,68,914 from his bank account. Police recovered APK files that imitated 18 banks and said the malware forwarded itself to the victim's WhatsApp and Telegram groups.
Source: ETV Bharat
What a malicious APK can do once installed
- Read SMS and notifications to capture one-time passwords and alerts the customer would otherwise see.
- Abuse accessibility services to read what is on screen and tap on the victim's behalf.
- Draw overlays that copy a banking login screen and capture credentials.
- Mirror or share the screen so a remote caller can watch a payment being made.
- Spread itself by messaging the same file to the victim's contacts.
How a banking app can detect and stop it
A bank cannot stop a customer from installing a file. It can make the app aware of the hostile environment and refuse to act in it. Mobile RASP (runtime application self-protection) runs inside the app and looks for exactly the behaviours above:
- Detect overlays and accessibility services that are active on top of the app.
- Detect screen sharing, screen mirroring and remote-access tools.
- Detect hooking, tampering and a modified or repackaged app.
- Check, with a hardware-backed device proof, that the phone is still a clean, enrolled device.
- Pass those signals to a risk engine that can allow, step up or block the payment before money moves.
See what mobile RASP is, how overlay attacks work and how screen-sharing fraud is prevented.
Advice to give your customers
- Install apps only from the official store. Banks do not send APK files over WhatsApp.
- Do not switch on "install unknown apps" for a messaging app.
- Never grant SMS, accessibility or overlay permissions to a bill or challan app.
- If a file was installed, switch to airplane mode, uninstall it, change banking passwords from a clean device and call the bank and the 1930 cyber helpline.
Frequently asked questions
What is a fake APK scam?
A fraud in which a victim is tricked into installing a malicious Android app file, often sent on WhatsApp as a bill update or bank app, that then reads messages and acts on the phone.
Can a banking app detect fake APK malware?
It can detect the behaviour the malware relies on, such as overlays, accessibility abuse, screen sharing and tampering, and refuse to proceed in that environment. It does not need to recognise each file.
Does Play Protect stop fake APKs?
Play Protect helps, but it works on known threats and on what the user allows. An app should still defend itself at runtime. See the Play Integrity limits page for what the platform checks do and do not prove.
How does NonaShield help?
Its runtime protection and hardware-backed device check flag a compromised phone, and the risk engine can step up or block the payment before money moves.
See it on your app.
Book a free 30-day shadow pilot, or download the platform brochure.