How the scam works
- You get a message about something urgent, such as a pending traffic challan, a bank KYC update, a wedding invitation or a delivery.
- It includes an APK file or a link that downloads one.
- The app asks for SMS and Accessibility permissions.
- The attacker can read your OTPs and messages and may move money.
How to protect yourself
- Never install an APK sent to you. Official banks and government services use the Play Store or their own verified websites.
- Keep Install unknown apps switched off.
- Do not share OTPs with anyone.
- If you already installed something, switch on airplane mode, uninstall the app and call your bank.
Where to report
Call the National Cyber Crime Helpline on 1930 as soon as possible, and report at cybercrime.gov.in.
How antivirus helps
A security app can check new installs and warn about risky permissions. Psylinks AV scans apps at install time, but nothing replaces not tapping the file.
Frequently asked questions
Can I get my money back?
Report at once. Speed matters. Call 1930 and your bank immediately.
How do I tell a real bank app from a fake one?
Real banks publish their app on Google Play, and the link comes from the bank's own website.
Psylinks AV is in beta. A private, lightweight antivirus for Android with no ads. First year free. Join the beta.