The Wedding Card That's an App: Why a .apk Invite on WhatsApp Can Empty Your Bank Account
A wedding card is a PDF or a JPG. A file ending in .apk is an Android app, and once it's installed and allowed, it can read your SMS, OTPs included. Reported cases from Bengaluru, the police line, the setting that stops it, and where to report in India, the US and everywhere else.
Chachaji forwards a wedding card on WhatsApp. The file is called Shaadi_Card.apk. It isn't a card: it's an Android app, and it's one of the most reported scams of India's wedding season.
What the 'card' does
Security researchers at K7 Labs analysed a wedding-invite app aimed at Indian users. It asks you to allow installs from unknown sources, then for access to SMS and contacts, then for Accessibility, which gives it control of the phone. From there it can read bank OTPs as they arrive.
Genuine invitations are in PDF or JPG formats. Treat APK files as fraud.
— Hyderabad Cyber Crime Police, via ETV Bharat, 25 May 2026
In Bengaluru, a shop owner lost ₹5,00,440 in UPI transfers within minutes, Digit reported in May 2026. In July a forest officer lost ₹9,96,659 to an engagement invite sent from a friend's number. In Bijnor, one 'card' forwarded into a WhatsApp group led to over 100 phones being hacked.
The setting that stops it
On Pixel and many Android phones: Settings, Apps, Special app access, Install unknown apps. The setting is per app, so open WhatsApp and your browser and make sure each says Not allowed. On Samsung it's under Security and privacy, More security settings, Install unknown apps. Keep Google Play Protect on; it's on by default.
Where to report
- India, money lost: call 1930 or file at cybercrime.gov.in.
- India, the message itself: Chakshu, on Sanchar Saathi.
- US: ReportFraud.ftc.gov.
- Anywhere else: econsumer.gov.
This is the long version of Phone Safety #02, a reel in Hindi for @buildjayy on Instagram. If you're building an app, send me the word BUILD there, or start with the brief form on the front page.
Sources: ETV Bharat on Hyderabad Cyber Crime Police; The Tribune on Himachal Police; K7 Labs; Kaspersky's Securelist; Digit and News Karnataka on the Bengaluru cases; Aaj Tak on Bijnor; Google's Pixel help and Play Protect pages; Samsung; I4C; Chakshu; and the FTC on econsumer.gov.
- 7 Nov 2026
- Published, with the reel.
Product builder from Surat. Ships his own apps, runs live broadcasts, and takes on a few founders a year for product, brand and growth. hey@jaybutani.com