HDFC Bank issues urgent alert on new Android malware targeting customers

In an APK scam, fraudsters typically use social engineering tactics by impersonating bank employees or government officials.

HDFC Bank, India’s largest private sector bank, has issued an urgent advisory warning customers against a rising wave of cyber fraud involving malicious APK (Android Package Kit) files. The bank is intensifying efforts to spread awareness about this dangerous scam, which has led to financial losses and phone data breaches across the country.

 

What is APK Fraud?

In APK fraud, fraudsters impersonate bank employees, government officials, or representatives of trusted companies to manipulate victims into downloading and installing harmful APK files on their phones. Once installed, the malware grants remote access to the fraudsters, enabling them to steal sensitive data, redirect calls and texts, and even drain victims’ bank accounts through unauthorized transactions.

 

 

How the Scam Works – 

 

Impersonation Tactic: Victims receive messages or calls claiming to be from banks, the Income Tax Department, or transport authorities, often citing urgent issues like KYC updates, income tax refunds, or unpaid traffic fines.

 

Malicious Link Sent: A fake APK link is shared via SMS, email, or messaging platforms. Victims are coaxed into clicking and downloading the file.

 

Malware Installation: Once installed, the APK silently deploys malware, granting full remote access of the victim’s device to the attacker.

 

Fraudulent Transactions Begin: Within minutes, fraudsters start initiating unauthorized financial transactions. Victims typically discover the scam after receiving bank alerts for debits they didn’t initiate.

 

Some examples:

a. Fraudsters reach out to customers via phone calls, emails or messages claiming to be from the bank and their KYC needs to be updated immediately. They create a sense of urgency and fear of the account getting blocked. The fraudsters then share fake APK links which could be embedded with a bank logo and ask customers to install it. Once installed, the app prompts them to enter sensitive details like the person’s account number, credit/debit card information or OTPs which are instantly stolen and misused for fraudulent transactions.

 

b. Fraudsters could also impersonate transport authorities (RTO) and send fake messages and emails related to a pending e-challan. These messages contain malicious APK links, and when clicked, compromise the victim’s phone.

 

• Tips to protect yourself from APK fraud
•  Do not click on suspicious links or install apps / files received via social media, SMS, or email claiming to be from institutions like, the RTO, Income Tax Department, or Bank officials.

 

Ensure your device has reliable antivirus or anti-malware software that can detect and block harmful files.

 

Do not download third-party apps over a call request from an unknown person. Download apps only from trusted sources or official websites.

 

Verify the legitimacy of the message / emails through the respective official website. Report fraudulent/suspicious calls, messages on the Chakshu portal at https://sancharsaathi.gov.in/ or via the Sanchar Saathi mobile app.

 

HDFC Bank has also urged its customers to remain vigilant against scams, such as “digital arrest” fraud, where fraudsters impersonate law enforcement or government officials and threaten victims with a digital arrest warrant for reasons that could range from alleged tax evasion, regulatory violations, financial misconduct among others. 

 

Other frauds commonly seen include investment scams, where fraudsters promise unusually high returns on investments in stocks, IPOs, cryptocurrency, etc. via fake automated investment platforms and promoted via social media platforms. Fraudsters target the emotions of victims to perpetuate frauds by using the GTH – Greed, Threat and Help method.

 

"In the event of falling prey to online fraud the victim should immediately report the unauthorised transactions to the bank in order to get the payment channel blocked, i.e., cards/UPI/net banking to safeguard against future losses. Customers should also file a complaint by calling 1930, a helpline number started by the Ministry of Home Affairs (MHA)

as well as submit a complaint on the National Cyber Crime Reporting Portal https://www.cybercrime.gov.in," said HDFC Bank in a statement.

 

What to Do If You Are a Victim

In the unfortunate event of falling prey to any online scam, HDFC Bank advises:

 

Immediately report unauthorized transactions to your bank to block further access to cards, UPI, or net banking.

 

Call 1930, the cybercrime helpline launched by the Ministry of Home Affairs.

 

File a complaint on the National Cyber Crime Reporting Portal.