RBI Warns Of Fake Banking Apps: How To Protect Your Money From Android Malware

A message saying your bank account will be blocked unless you update your know-your-customer (KYC) details may look convincing. It may include the bank’s logo and a link to download an app. But an Android Package Kit (APK) file received by WhatsApp or SMS can install malware that steals login details and intercepts one-time passwords (OTPs).

The fake app may copy the name, colours, and login screen of a genuine bank app. Once installed, it can request access to text messages, contacts, call logs, and notifications. Permissions for accessibility services or displaying over other apps can let it read what you type, place a fake screen over your real banking app, or forward OTPs to fraudsters.

“Fraudsters copy everything a customer would recognise: the bank’s logo, colours, app name and login screens. The fake app usually arrives as an APK file over WhatsApp or SMS, and the message creates urgency,” says Iype Isac, Chief Delivery Officer, BankBazaar.

The message may claim your account will be blocked, your KYC update is pending, or reward points are about to expire. That pressure is a reason to pause. Installing an APK directly also bypasses the checks made by official app stores.

Check The App And Link Before You Install

Do not install a banking app sent as a file by message. Search for the app on the Google Play Store and check that the developer is the bank. You can also reach the app through the bank’s official website. Review the app’s listing, including its developer and download history, before installing.

Check a web address carefully before opening it. Indian banks are moving their websites to the “.bank.in” domain; a link claiming to be from your bank but using a different address deserves scrutiny. If you are unsure, call the bank using the number printed on your card or passbook.

Keep “Install unknown apps” switched off and Google Play Protect on. Be cautious if an app asks for access to SMS or Accessibility Services without a clear reason. A bank will not send an app file over WhatsApp or SMS. Do not share an OTP, password, or UPI PIN in response to a message or call.

What To Do If You Have Installed A Suspicious App

If you have installed a suspicious app, disconnect the phone from the internet by switching on flight mode. Then uninstall the app. If it will not uninstall, revoke its Accessibility and device administrator permissions first. If it persists, back up essential data and consider a factory reset.

“Speed matters most, and the first hour can decide whether money is recovered. Switch on flight mode or disconnect the device from the internet so the app can’t send any more data, then uninstall it,” says Isac.

From a different, trusted device, contact your bank’s official helpline. Ask it to block cards, suspend net banking and UPI access, and help you change passwords and your UPI PIN. Report suspected cyber financial fraud to helpline 1930 or at cybercrime.gov.in as soon as possible. Quick reporting may help authorities and banks try to freeze funds before they are moved. Suspicious calls and messages can also be reported through the Chakshu facility on the Sanchar Saathi portal.

Notify your bank in writing as well as by phone, and keep the complaint number, screenshots, and the original message. Under RBI’s current directions, a customer’s liability in some third-party breach cases may be zero if the bank is notified within three working days of receiving its transaction communication; the outcome depends on the circumstances.

Revised RBI directions are set to apply to transactions from January 1, 2027, and include downloading malicious apps among examples of customer negligence. Keep checking bank statements and your credit report in the following weeks for unfamiliar transactions or credit enquiries.

FAQs

How can I check whether a banking app is genuine?
Download it from the Google Play Store or reach it through the bank’s official website. Check the developer and avoid APK files sent by WhatsApp or SMS.

What should I do if I have installed a suspicious banking app?
Disconnect the phone from the internet and uninstall the app. From a trusted device, contact your bank to block access and change your passwords and UPI PIN.

How can I report suspected fraud?
Call 1930 or report it at cybercrime.gov.in as soon as possible. Also notify your bank and keep the complaint number, screenshots, and the original message.