Scam alertIndia
“Please Check Our Wedding Invitation” — the APK File That Empties Your Account (India)
Posted 16 Sep 2026
It arrives as warmth, not a threat: “Namaste ji, please check our wedding invitation and do come 🙏” from a number you don’t recognise, with an attachment named something like Wedding_Invitation.apk or Shaadi_Card.pdf.apk. Nobody questions a wedding card — which is exactly why this is spreading across India faster than any phishing text.
The file isn’t a card. It’s an Android app, and installing it asks for permission to read your SMS, see your notifications, and use “accessibility” features. That combination is everything: the scammers can now read every OTP your bank sends, approve UPI and net-banking transactions in the background, and quietly forward the same “invitation” to your contacts so it keeps travelling. Victims often notice nothing until the money is already gone.
The same trick is circulating with other disguises — traffic e-challan notices, “bank statement” files, PM Kisan and other scheme apps, and courier-tracking files. If a message asks you to install anything, the subject line doesn’t matter.
What to Do
- Never install an .apk file sent on WhatsApp, Telegram, or SMS — real apps come only from the Google Play Store or Apple App Store.
- Treat a file ending in .apk as malware even when the name says PDF, JPG, or “card” — “Invitation.pdf.apk” is an app, not a document.
- Getting a wedding invite from an unknown number? Call the person on a number you already have. Don’t open the file to “see who it is”.
- Never grant an app permission to read your SMS, notifications, or “accessibility” unless you know exactly why it needs them.
- Already installed it? Turn on airplane mode at once, uninstall the app (boot into safe mode if it resists), call your bank to freeze the account, change your banking and UPI PINs from a different device, then report at 1930 / cybercrime.gov.in.
- Warn your contacts — the app sends itself onward from your number, so people who trust you are next.