e-Challan and Bank Reward APK Scam: What To Do

Conceptual illustration: An anonymous smartphone beside a glass downloadable file icon labeled only APK, with a red threat crack and a lime protective barrier. Headline: APK FILE. HIDDEN THREAT.

AI-generated illustration by CyberShitty. Not a photograph or a document from the organisations named.

How it works

You receive a WhatsApp message, often forwarded from a known contact's hacked account, about an e-challan, an electricity disconnection, PM-Kisan or expiring bank reward points.
The message includes an .apk file or link and asks you to install it to pay or claim.
The app asks for SMS, notification or accessibility permissions, then shows forms for Aadhaar, PAN, card details or UPI PIN.
It quietly reads your OTPs, lets fraudsters make transactions, and may take over your WhatsApp to send itself to your contacts.

Composite example, not a real case

The e-challan that came from a friend

Meena, 52, a school clerk in Nagpur, gets a WhatsApp message from a friend's number about an unpaid traffic challan, with a file ending in .apk.
She taps it. Her phone asks whether to allow WhatsApp to install unknown apps, and she allows it to get the challan paid.
The app asks for SMS and notification access, then shows a form for her Aadhaar, card details and UPI PIN, which she fills in.
Over the next hour, OTPs arrive and vanish. Money is taken from her account, and her contacts start getting the same file from her number.
Her son puts the phone in flight mode, uninstalls the app and calls the bank to block her cards and UPI. They call 1930 and file on cybercrime.gov.in.

Who gets targeted

Android phone users on WhatsApp. The message often comes from a known contact whose account has already been taken over, so it looks trusted.

Red flags

Any .apk file sent over WhatsApp or SMS, even from someone you know.
A challan, bill or reward that you are told to pay or claim through an app instead of the official website.
An app asking for SMS, notification or accessibility access.
Friends saying they received the same file from your number.

What to do

Do not install apps from links or files; verify challans on the official Parivahan e-challan site and bills on your provider's own app or site.
If you installed one, switch on flight mode, uninstall the app, and call your bank to block cards, UPI and net banking.
Call 1930 and file a complaint on cybercrime.gov.in if any money was taken.
Change banking passwords and UPI PIN from a clean device, and re-secure your WhatsApp with two-step verification.
Warn your contacts not to open files sent from your number.

How to protect yourself

Keep 'Install unknown apps' switched off for WhatsApp, your browser and your file manager. On most Android phones it is under Settings, Apps, Special app access.
Never install an .apk file sent over WhatsApp or SMS, even from family or friends. Install apps only from the official app store.
Check challans only on the official Parivahan e-challan site, and bills only on your provider's own app or website.
Be suspicious of any app that asks for SMS, notification or accessibility access. A bill or challan app does not need them.
Turn on two-step verification in WhatsApp, so a stolen account is harder to take over and use against your contacts.
If a friend sends a file out of the blue, call them on their usual number before opening it.

Official tools, explained

Step-by-step guideInstalled an app from a link or ad? How Accessibility malware takes over phones, and what to do

The numbers

A December 2025 CYFIRMA analysis described a WhatsApp-spread 'RTO e-Challan' APK that intercepts OTPs and harvests Aadhaar, PAN, card and UPI PIN details. No official national loss figure exists for APK fraud.

Chakshu reports of malicious link or website communications rose from 8,304 in 2024 to 19,418 in 2025, DoT told the Rajya Sabha. — PIB (DoT) — Chakshu facility of Sanchar Saathi: suspected fraud communications reported, Rajya Sabha reply (5 Feb 2026)

Questions people ask

What happens if I installed an APK from WhatsApp?

These apps can read your OTPs, collect the card, Aadhaar and UPI details you type in, and send themselves to your contacts. Switch on flight mode, uninstall the app, and call your bank to block cards, UPI and net banking.

I only received the APK file and did not install it. Am I safe?

The scams described here need you to install the app and give it permissions. Delete the message and the file without opening it, and tell the sender their account may be hacked.

My friend sent me the file. Why would they send malware?

They probably did not. These apps can take over a victim's WhatsApp and send themselves to everyone in the contact list. Call your friend on their usual number to warn them.

Is the e-challan I got on WhatsApp real?

Do not pay it through any app or link in the message. Check for challans yourself on the official Parivahan e-challan site.

Will my bank return money taken by the app?

It depends on the facts and on how quickly you report. Under RBI rules, the sooner you tell your bank in writing, the less of the loss you can be made to bear, so report at once and also call 1930.

Desk coverage

Share on WhatsApp

Sources

Other scamsDigital arrest scam Investment and trading scam Task and part-time job scam UPI, QR code and collect-request fraud Sextortion video call scam Fake customer care number scam