How to Spot Fake APKs and Scam Apps on Android
Fake apps are built to resemble the ones you trust - banking, e-wallets, WhatsApp, even wedding invitations - with one goal: to get you to install and open them. In Indonesia, this pattern steals OTP codes, takes over accounts, and drains bank balances.
This guide summarises the signs to check in under a minute before installing anything, and the steps to take if you or your family already installed one.
Sign one: it arrives by chat, not from an official store. Banks, e-wallets, couriers, and agencies never send apps over WhatsApp or SMS. Files calling themselves wedding invitations, traffic tickets, or parcel receipts - ending in .APK, delivered through chat - are a well-documented Indonesian scam pattern; genuine invitations arrive as links or PDFs. The family rule is absolute: no app is ever installed from a chat. Sign two: the name and developer are almost right, but not right. Fakes copy names with small changes - a swapped letter, an added Mod or Pro, a slightly different icon. Compare with the official listing: a banking app's developer is the bank itself, and genuine download counts run into the millions. The next giveaway is the promise: free Premium forever, instant followers, money for no work.
Sign three: it demands dangerous permissions immediately. Fake apps typically ask straight away for Accessibility, SMS reading, display over other apps, or device administrator - dressed up as 'verification'. For an invitation viewer, such requests make no sense; Accessibility plus SMS access is precisely the combination banking scams use to read OTP codes and control your phone remotely. After installing, watch for a hot phone, draining battery, ads on the home screen outside any app, or a fake-looking bank login over other apps.
If you already installed one, act immediately: switch on airplane mode, do not open any banking or e-wallet app, and delete the suspicious app. From a safe device, contact your bank to block access, change key passwords - main email first - and switch on two-step verification. Run a Play Protect scan after removal. If you handed over an OTP code, report it to the bank and police with screenshots, and consider a factory reset after backing up. Speed in the first hour decides how much loss can be prevented.
Frequently Asked Questions
I received a wedding-invitation APK from a number I know. Does that make it safe?
No. The sender's number may itself have been hijacked - that is exactly how this pattern spreads, from one victim to all their contacts. Confirm by voice call - and still never install it.
How can a fake app drain a bank account?
Usually by reading OTP codes via SMS or Accessibility permission, then signing into the victim's banking - or by showing a fake bank login to harvest the password. Banks never ask for an OTP code: anyone who asks is a scammer.
Can fake apps get into Play Store?
Rarely, but it has happened, and Google removes them once detected. So keep checking developer, reviews, and permissions even on Play Store.
English edition. The complete step-by-step version is on the Indonesian guide page.