You get a message saying your bank KYC is pending.
There's a link, or a file attached, and it looks official enough.
A fake app can look identical to the real thing โ same icon, almost the same name.
And it's built to do one thing: steal your logins, your OTPs, or your money.
The most dangerous ones pretend to be banking or payment apps.
How do these apps reach me?
Rarely through the app store you already trust.
Usually as a link or an APK file over WhatsApp, SMS or email โ "install our new KYC app".
An APK is an Android installation file, the kind that arrives outside the Play Store.
Sometimes it's a lookalike sitting on the app store itself.
A slightly-off name, and very few reviews.
And sometimes it's a fake "update required" pop-up or an advertisement while you're browsing.
All three routes rely on the same thing.
You're in a hurry, and the message sounds official.
What does a fake app do once installed?
It asks for permissions no ordinary app should need.
Reading your SMS is the big one, because that's how it grabs your OTPs.
Accessibility is the other, because it lets the app watch what you type.
Accessibility settings exist to help people with disabilities use their phone.
That's exactly why they hand an app so much reach.
Grant those two, and a scammer can log in as you without ever seeing your screen.
How do I stay safe?
Only ever install from the official Play Store or App Store.
Never from a link someone sends you, however well you know the sender.
Never install an APK for bank KYC โ banks don't work that way.
Before installing, check three things: the developer name, the reviews, and the download count.
A real bank's app lists the bank itself as the developer.
A fake one has barely any downloads and a developer you've never heard of.
Keep "install unknown apps" switched off on your phone.
And delete any cracked or modded versions of apps you may have installed.
Those are free for a reason.
A fake app can look exactly like the real one.
The only safe source is the official store.
Things to Remember
- Install only from the Play Store or App Store, never from a link.
- Treat any "bank KYC app" sent to you as a scam, without exception.
- Check the developer name, review count and download count first.
- Keep "install unknown apps" turned off.
- Never grant SMS or accessibility permissions to an app you don't fully trust.