New Bank Scam In Town: How I Nearly Got Cheated Of My Life's Savings & What You Can Do To Save Yourself

On a Wednesday afternoon like any other, I received a phone call that could have cost me my life’s savings.

The person on the other end claimed to be from my bank. He knew my full name, my phone number, and even the bank I use. He said my account’s KYC (Know Your Customer) was incomplete and urgently required my PAN card details. I was told several emails and WhatsApp messages had already been sent, none of which I had received or found upon checking later.

Something felt off. I already knew that my PAN card was linked to my bank account. Then came the clincher — he sent me an APK file on WhatsApp and insisted I fill in my details there to proceed. That’s when it hit me. This was fraud.

As I grew suspicious, I started recording the call. Upon hearing the automated call recording announcement, he apparently remained unfazed and remarked, "You can, of course, record this call; there's no issue with that. You can log into your HDFC mobile application, and you will see an option to update your details." 

I ended the call, letting the scammer know this appeared to be an APK scam, and I was not going to install anything.

How They Nearly Got Me: The Modus Operandi

Here's the scammer's modus operandi, as I gathered from my experience:

• Call the customer, claiming their KYC is not done and PAN details are needed.
• Claim that a deadline is missed, create a sense of urgency for the victim to fall into the trap immediately, and insinuate that their account access is under threat.
• Claim that multiple emails were sent, and the bank officially sent WhatsApp messages. Give it a slight interrogatory tone.
• Sound 'official' and authoritative; remain unfazed when you hear that the call is being recorded by the victim now.
• Pray that your victim doesn't know about the APK scam, or it's game over as soon as you send that APK file on WhatsApp.

I didn’t fall for it, but only because I was aware of what the APK scam is. When I spoke to my father about it immediately after, he told me his friend was just narrating to him his own such experience. This person also saved himself from facing financial fraud, as he acted on suspicion; instead of installing the APK file, he asked his accountant to check his account's KYC status.

What Exactly Is An APK Scam?

APK stands for Android Package Kit — a file format used to install apps on Android devices. Scammers exploit this to send malicious files that can hijack your phone.

Once installed, these apps demand extensive permissions: access to your contacts, SMS, camera, location, microphone, and more. This gives hackers full control of your device, often without your knowledge. They can steal passwords, intercept OTPs, and make unauthorised transactions.

What My Bank Told Me

After the incident, I reached out to my bank's official relationship manager. He assured me that there was no breach from the bank’s end. Instead, he explained that such data may leak through CIBIL enquiries on third-party platforms.

“There’s no data breach from our side,” he said. “It happens when you make a CIBIL enquiry; they can find your details through your CIBIL records.” He added that bank staff are not allowed to use personal phones at work and can only reach customers through official landlines or email.

“Whenever you receive any requests from an unauthorised number, please do not share any OTP or details with them,” he advised.

What You Must Do To Stay Safe

Here are key precautions to protect yourself from APK-based scams:

• Never install APKs from SMS, WhatsApp, or any unofficial source.
• Use antivirus apps to scan files before installation.
• Check permissions — apps requesting access to unrelated features are a red flag.
• Contact your bank directly via official numbers if you receive suspicious calls or messages.
• Report incidents to the National Cybercrime Reporting Portal or call 1930.
• Verify messages through the Sancharsathi portal.

Banking scams are an unfortunate daily reality; one wrong click can leave us without our life's savings, along with the lifelong guilt and emotional pain of not being vigilant when it truly mattered. The pervasive nature of these frauds makes it important for us to be aware of digital frauds and also report the new scams we encounter so that our experiences can enable us to save others.

Bottom Line: Stay alert. Stay informed. Trust no unknown link. And never install an APK file from a stranger.