Do not trade device security for a download

01

Why APK requests deserve extra caution

An APK installed outside Google Play bypasses store distribution checks and may require you to allow installs from an unknown source. That does not prove malware, but it transfers the verification burden to you.

For a money-related service, device compromise can expose messages, notifications, stored passwords, contacts and payment apps.

02

Stop if you see these instructions

• Disable Play Protect or antivirus.
• Give accessibility-service or device-admin access without a clear need.
• Install a “security update” sent in chat.
• Allow screen sharing while a banking or UPI app is open.
• Ignore a browser or operating-system warning.
• Download a renamed ZIP or file with a double extension.

03

A practical verification sequence

1. Identify the publisher.Find a legal entity and a primary source linking it to the file.
2. Confirm the distribution route.A third-party page claiming “official APK” is not enough.
3. Check permissions.Ask why the app needs contacts, SMS, accessibility or file access.
4. Keep safeguards on.Never disable operating-system protection to complete an install.
5. Do not mix with banking.Avoid unknown apps on the same device used for payments.

04

iPhone “app” claims

A website added to the iPhone Home Screen may be a progressive web app or simply a shortcut. It is not necessarily App Store-reviewed. Check the hostname each time and understand that the same web-service, identity and legal questions still apply.

05

If you already installed a suspicious app

Disconnect the device from networks, remove sensitive permissions, uninstall the app, scan the device and change exposed credentials from a different trusted device. Review bank and UPI activity. If money or identity data may be compromised, contact the relevant provider and report cybercrime promptly.

Open the full incident checklist →