A ‘wedding invitation’, ‘parcel tracking’ or ‘cleaning service’ app sent as a file can give scammers full control of your phone.
An APK is an Android app file. Scammers send them on WhatsApp or Telegram disguised as invitations, delivery apps or booking forms. Once installed, the app can read your SMS — including bank TAC codes.
What to do
- Never install apps sent in chatsOnly install apps from Google Play or the App Store.
- Check the file nameAnything ending in .apk sent by a stranger — or even a friend whose phone may be hacked — is a red flag.
- Keep ‘Install unknown apps’ switched offIn Android settings, do not allow your browser or WhatsApp to install apps.
- Installed one already? Go offlineTurn on airplane mode, call your bank from another phone, and get the device checked.
- Change passwords from a clean deviceEmail, banking and social media — and switch on two-step verification.
When to call a professional: Our digital forensics team can examine your phone and help you understand what was taken. Digital Forensics →
Not sure what to do next? Try the free Case Assessment — 3 minutes · private · no sign-up. See what you already have, what is missing, and the lawful next steps. Start the free assessment →
Emergency? Call 999. Scam in progress? Call the National Scam Response Centre at 997. This tip is general information, not legal advice.