"Wedding Invitation" - two words sandwiched between pink bouquets looked enticing to Noor Nahid Khan, a 42-year-old businessman from Bengaluru. He tapped on the WhatsApp message that read:
"We're happy to invite you to our wedding. Kindly download the attached invitation for complete details of the ceremony. Your presence and blessings will make our special day truly memorable," with a heart emoji at the end.
"We look forward to celebrating this beautiful moment with you," the message further read, followed by another bouquet and sparkle emoticon.
An APK file followed the text.
Khan downloaded the file, unknowingly providing device access to the sender.
On April 16, between 4:45 am and 4:54 am, Rs 5,00,440 was allegedly siphoned off from Khan's bank account through multiple UPI transactions.
According to the police, the APK file was allegedly used to install a mobile application outside the Google Play Store, without letting the receiver know. Through this, the sender may have gained permission to access several other applications like Camera, Google Pay, and bank apps, and confidential information stored on the device.
Based on the complaint, police have registered a case of identity theft and cheating against unknown persons under Sections 66(C) and 66(D) of the Information Technology Act, 2000. A case has also been registered under the Bharatiya Nyaya Sanhita (BNS), 2023.
Investigators suspect that the same message and APK file may have been circulated to several other mobile users across the city as part of a larger cyber fraud operation.
Further investigation into the matter is underway.
What You Need To Know About APK Files
An APK (Android Package Kit) file is used by Android operating system for the distribution and installation of apps. It contains all necessary code, assets and resources for an application to run.
The wedding invites are either shared as images (JPEG or PNG), videos (MP4), or documents (PDF).
The incident has drawn attention to the need for digital literacy.
"People need to know the difference between JPEGs and APKs," wrote Sumit Gupta, founder of the Crypto company CoinDCX, on X (formerly Twitter).
"NEVER download or install random .apk files sent via WhatsApp from unknown numbers, even if it looks like a harmless wedding invite (sic)," he added.
Digital literacy is the need of the hour!
— Sumit Gupta (CoinDCX) (@smtgpt) May 11, 2026
People need to know the difference between JPEGs and APKs.
NEVER download or install random .apk files sent via WhatsApp from unknown numbers, even if it looks like a harmless wedding invite.
Scammers are actively preying on this… https://t.co/0ZKEHYrYEs
"Scammers are actively preying on this lack of awareness. It is up to all of us to take a few minutes to teach our loved ones these basic digital survival skills. Stay safe everyone!"
Track Latest News Live on NDTV.com and get news updates from India and around the world
