Background and Timeline
On January 10, 2026, a 27-year-old Indian Navy sailor posted at INS Agrani, Colaba, Mumbai, was duped of ₹90,811 after downloading a fake “IndusInd Credit Card APK” sent via WhatsApp from an unknown number. Believing the application to be genuine, as he held an actual IndusInd Bank credit card, the sailor installed the app on his phone.
Modus Operandi
The scam exploited the APK (Android Package Kit) vector, a rapidly growing threat in India. The fake app, once installed, requested extensive permissions and transmitted sensitive data to the fraudsters. Within minutes, unauthorized transactions totaling ₹80,999 (at Reliance Retail) and ₹9,812 (via One Mobikwik System) were executed using the sailor’s credit cards. Shortly after, the victim received another call from a different number, with the caller impersonating a bank manager and demanding an additional ₹2,499 to “stop annual charges.” The sailor, now alert, refused further payment and reported the incident.
Number of Victims and Financial Impact
The sailor lost a total of ₹90,811. While this case involved a single victim, APK scams have surged across India, with over 1.2 million cases reported in 2025 alone. The use of fake apps to steal credentials and execute unauthorized transactions is a widespread and growing menace.
Investigation Progress and Agencies Involved
The victim immediately called the cyber helpline 1930 and lodged an online complaint via the National Cyber Crime Reporting Portal (cybercrime.gov.in). The Colaba Police registered an FIR and, with assistance from the cyber cell, began tracing the phone numbers and financial trail involved in the scam. The investigation is ongoing, with efforts focused on identifying the perpetrators and recovering the stolen funds.
Arrests and Suspects
No arrests have been reported as of this writing, but the case is under active investigation.
Broader Implications and Trends
APK scams represent one of the fastest-growing forms of cyber fraud in India, exploiting low digital literacy and the widespread use of Android devices. Fraudsters use social engineering to distribute malicious apps via WhatsApp, SMS, or email, often mimicking official portals or banks. The incident underscores the importance of cyber awareness, strict app installation practices, and robust technological safeguards. Public advisories now emphasize downloading apps only from official app stores and avoiding links from unknown sources.