An Agra resident allegedly lost ₹11 lakh after installing a malicious APK file sent on WhatsApp by a fraudster posing as a bank official. The file, named “Pension Plan.apk,” was presented as information about a pension scheme but allegedly installed hidden malware on the victim’s Android phone, giving the attacker access to sensitive banking data and enabling unauthorised transactions from a fixed deposit account.
According to the complaint, the victim received a call on June 14 from an unidentified number. The caller introduced himself as an official of a public sector bank and claimed to be sharing details of a new pension plan. A WhatsApp message containing the APK file was then sent to the victim.
FCRF’s Flagship Cyber Law Certification Returns With a New Four-Week Cohort
Malicious File Sent as Pension Plan
Believing the message to be genuine, the victim clicked on the file. Instead of opening a document, the APK allegedly installed a hidden application on the smartphone.
Investigators said the application enabled unauthorised access to the device. The attacker allegedly gained control over SMS messages, OTPs, banking applications and other sensitive data stored on the phone.
Using this access, the fraudster transferred ₹11 lakh from the victim’s fixed deposit account to unknown bank accounts. The fraud came to light after the victim noticed suspicious account activity and reported the matter to cybercrime authorities.
Cyber Police Trace Digital Trail
Cyber police have begun investigating the destination accounts, the mobile number used in the fraud and the digital footprint of the APK file. Authorities are examining transaction trails, device access records and other technical evidence linked to the malware.
Investigators suspect that such frauds are often carried out by organised networks rather than a single individual. These networks may include callers, malware handlers and intermediaries who route stolen funds through mule accounts.
Officials are also checking whether similar complaints have been reported in other areas. The case is being examined as part of a broader pattern of APK-based scams in which malicious files are disguised as banking updates, investment plans, job offers or government scheme documents.
Citizens Warned Against Unknown APK Files
Cybercrime expert and former IPS officer Prof. Triveni Singh said the case shows how social engineering and mobile malware are being combined in financial fraud. He said criminals often trick users into installing harmful applications themselves, allowing attackers to capture OTPs, read messages and monitor banking activity.
Law enforcement agencies have warned that legitimate banks do not send APK files for schemes, updates or account-related information. Citizens have been advised not to download files received through WhatsApp, SMS or unknown links.
Users have also been urged to disable installation from unknown sources, avoid granting unnecessary app permissions and keep mobile devices updated. Victims of suspected cyber fraud should immediately contact the national cybercrime helpline 1930 and report the incident through official channels.
