Beware of .APK File Scams: Protect Personal Data and Customer Accounts!

The current advancement of digital technology offers tremendous convenience in accessing banking and financial services. However, alongside this convenience comes an increased risk of cybercrime that requires our collective vigilance. One prevalent form of cyber fraud involves the sending of application files in .APK format via instant messaging apps—such as WhatsApp, Telegram, and SMS—as well as through social media.

 

 

What Is an APK File and Why Is It So Dangerous?

An APK (Android Package Kit) is the standard file format used to install applications on devices running the Android operating system. In principle, this file format is safe when downloaded from official sources. However, APK files sent privately by unknown parties and installed outside of official app stores carry a very high risk.

 

In a common scam scenario, the perpetrator deliberately embeds malicious software—such as malware or spyware—into the APK file. Once this fake application is installed on a mobile phone, the malware can operate covertly to:

• Stealing personal data stored on the device.
• Accessing SMS messages and incoming notifications, including secret codes such as One-Time Passwords (OTPs).
• Taking over the victim's WhatsApp or social media accounts.
• Recording the device's screen activity in real-time without the user's knowledge.
• Stealing critical banking information, ranging from User IDs, PINs, and passwords to debit or credit card numbers.

By gaining such access, criminals can take control of the device and drain the victim's account balance remotely.

 

 

Commonly Used Disguise Tactics for APK Files

Fraudsters constantly update their tactics to ensure potential victims remain unsuspicious and are prompted to click on the file. Here are some of the most common guises used to send APK files:

• Fake Digital Wedding Invitation
• The perpetrator sends an APK file named to resemble a wedding invitation document, enticing the victim to open it.
• Courier Photo or Package Shipping Receipt
• The scammer poses as a delivery courier and sends a photo of a package or a shipping receipt in APK format.
• Tax Bill or Annual Tax Return (SPT)
• Posing as a government agency, the scammer asks the customer to check a tax bill via a provided APK application.
• ID Card (KTP)/Civil Registry Data Updates and Taspen Notices
• Exploiting population administration issues to trick customers into downloading a fake verification app.
• Fake Bank Transfer Proof or Transaction Notification
• Sending information about suspicious transactions or fake transfer receipts in APK format and urging the customer to confirm immediately.
• Lure of Free Prizes or Lucky Draws
• Customers are informed they have won a balance giveaway or other attractive prize, then asked to download a specific APK for verification purposes.

 

 

Smart Steps to Avoid APK Scams

To protect personal financial data, diligently implement the following mitigation measures:

• Never click on or install APK files or suspicious links sent by unknown numbers.
• Always use official platforms like the Google Play Store or Apple App Store when installing any application.
• Do not grant access permissions (such as access to SMS, your gallery, or contacts) to apps from untrusted sources.
• Enable enhanced security features, such as Two-Factor Authentication (2FA), for all important accounts.
• Keep financial data confidential. Never share your PIN, password, OTP code, or card CVV with anyone.
• Ignore and report suspicious numbers attempting to contact customers using the methods described above.

 

If you detect signs of fraud or require emergency assistance, please immediately contact Call INA at 1500 738 or (021) 30500738 for direct assistance from Bank INA. Bank INA customers can also contact the Bank INA Call Center via WhatsApp at 0855 1500738, email [email protected], or visit www.bankina.co.id/id/hubungi-kami.

 

 

Bank INA is licensed and supervised by the Financial Services Authority (OJK) and Bank Indonesia, and is a participant in the Indonesia Deposit Insurance Corporation (LPS) guarantee scheme.