How this scam typically works
You receive a message — usually on WhatsApp or SMS — that looks like it's from a courier company, a bank, or a government agency. It might claim your parcel couldn't be delivered, your bank account needs an "urgent update," or you're due a tax or utility refund. The message includes a link to download and install an app directly, as an .apk file, rather than through the Google Play Store or Apple App Store.
Installing an app this way — called sideloading — requires you to bypass your phone's normal safety checks, usually by tapping "allow install from unknown sources." Once installed, the fake app asks for permissions that a real courier or banking app would never need: accessibility service access, permission to read your SMS messages, or the ability to see and control what's on your screen.
With those permissions granted, the attacker can read one-time passwords (OTP/TAC) sent to your phone, see everything happening on your screen in real time, and in some versions take control of your phone remotely — opening your own banking apps and moving money without you being able to stop it in the moment.
Warning signs
- Any message that asks you to install an app to "receive a parcel," "verify your account," or "claim a refund"
- The file is an .apk, or you're prompted to enable "install from unknown sources"
- The app requests accessibility, SMS, or screen-reading permissions immediately after install
- The message came from an unsaved number or a generic WhatsApp broadcast, not your bank's or courier's official app or channel
If you're being targeted right now
Do not install the app. Delete the message and do not click the link. If you want to check on a parcel, refund, or account issue, go directly to the courier's or bank's official app or website — never through a link sent to you — or call a number you already have saved, not one from the message.
If you've already installed the app
See I installed an APK from WhatsApp — what now for the exact recovery steps — this page is about recognising and avoiding the pattern, not the removal procedure itself.
If you've already lost money
See Scammed in Malaysia? The first 24 hours for what to do next — who to contact, in what order, and what to preserve as evidence — while there's still a chance of freezing a transfer.
FAQ
Is it dangerous to install any .apk file, or only ones from scam messages?
Any .apk installed outside the Play Store bypasses Google's standard security scanning, so it carries more risk in general. The specific danger here is an .apk sent unsolicited by message and disguised as a courier, bank, or government app — that pattern is almost always malware built to steal OTPs and screen access.
I installed the app but haven't noticed anything wrong — am I still at risk?
Yes. These apps are designed to run quietly in the background without obvious signs, sometimes waiting until you open your banking app to act. Follow the removal steps in I installed an APK from WhatsApp — what now even if nothing seems wrong yet.
Can this happen on iPhone too, not just Android?
Sideloading an .apk file specifically is an Android mechanism. iPhone scams that aim for the same outcome — remote access or credential theft — typically use a fake profile installation or a phishing link instead, so the specific file type differs but the underlying goal (taking control of your device or accounts) is the same.