Wedding season, and a message arrives on WhatsApp.
"You are invited! Please open the card."
Attached is a file with a name like Wedding_Invitation.apk.
That file is not a card.
What is an APK file?
It is an app installer for Android phones.
Opening it does not show you a picture.
It asks your phone to install a program.
What does this one do?
Police across India have warned about these fake invitations.
Once installed, the app can read your messages, including OTPs.
It can reach your photos, contacts and banking details.
Many versions then send the same fake invite to everyone in your contacts, from your number.
That is why it so often arrives from someone you know.
How do I spot it?
A real wedding card comes as a photo or a PDF.
Never as a file ending in .apk.
Be suspicious of any file you are asked to "install" to view.
Be extra careful if it comes from an unknown number, or a group you were just added to.
If a friend sends it, call them before opening anything.
Why does my phone even allow this?
Android lets you install apps from outside the Play Store, but asks first.
When you see a message about installing from "unknown sources", stop.
A genuine invitation never needs that permission.
What if I already installed it?
Switch on airplane mode straight away, so it cannot send anything else.
Go to Settings -> Apps, find anything you do not recognise, and uninstall it.
Change your banking and email passwords from a different, safe device.
Call your bank on the number on your card and ask them to watch for unusual activity.
Warn your contacts not to open anything sent from your number.
If money has gone, call 1930 and report at cybercrime.gov.in.
Things to Remember
- Real wedding cards are photos or PDFs, never
.apkfiles. - Never install an app to "view" something sent on WhatsApp.
- Call a friend before opening an odd file they sent.
- Installed it? Airplane mode, uninstall, change passwords from another device.
- Report losses on 1930 and cybercrime.gov.in.