MANGALURU: A 38-year-old senior chemist working at a company in Mangaluru allegedly lost Rs 1,18,707 after clicking a malicious Android application package (APK) link sent through WhatsApp under the pretext of tracking a chemical holder he had ordered.
According to a complaint filed with the CEN Crime police, the victim had ordered a chemical holder from GAIL India’s Khanpur facility on October 1. Four days later, on October 5, he received a link to an APK file from two unknown mobile numbers.
Believing the link was related to tracking his delivery, the chemist clicked on it. An application subsequently opened on his mobile phone, prompting him to enter his name and credit card details.
The fraudsters allegedly used the information to carry out multiple transactions, transferring a total of Rs 1,18,707 from his credit card to an account belonging to an unidentified person.
The CEN Crime police have registered a case and are investigating the incident.
Fake delivery tracking link used to target victim
The incident highlights how cybercriminals can exploit routine online purchases and delivery-related messages to deceive consumers. By making the link appear connected to an expected shipment, fraudsters can persuade recipients to open unfamiliar files and enter sensitive information.
In this case, the chemist reportedly believed the message was associated with the chemical holder he had ordered. The timing of the message, which arrived shortly after the order was placed, may have made the link appear genuine.
However, the application led him to a page requesting personal and credit card details. Once the information was entered, multiple unauthorised transactions allegedly followed.
The police complaint states that the money was transferred in several transactions to an account linked to an unidentified person. Investigators will need to establish how the application was used, trace the transactions and identify those responsible.
What is an APK fraud?
An APK is an Android application package used to install apps on Android devices. Cybercriminals sometimes circulate malicious APK files through messaging platforms, disguising them as delivery updates, traffic challans, banking alerts or other legitimate services.
When a user installs or interacts with a malicious application, it may expose personal information or enable unauthorised activity, depending on the permissions granted and the software’s capabilities.
Links sent through WhatsApp can also appear to come from familiar or plausible sources, making it important to verify unexpected messages before opening attachments or downloading applications.
How users can protect themselves
Consumers should avoid installing APK files received through unsolicited messages, particularly when the sender is unknown or the link claims to provide a delivery update, payment notice or official document.
For shipment tracking, users should visit the courier company’s official website or app and enter the tracking number provided by the seller. They should not rely on unfamiliar links sent through messaging platforms.
People should also avoid entering credit card details or other sensitive information on pages opened through unverified links. Apps should be downloaded from trusted official sources, and unnecessary permissions should not be granted.
Anyone who notices an unauthorised card transaction should contact their bank or card issuer immediately to block further transactions and report the incident. In India, suspected cyber financial fraud can be reported through the national cybercrime helpline 1930 and the official portal at cybercrime.gov.in.
The Mangaluru case serves as a reminder that even a message appearing to relate to a genuine purchase can be used as a vehicle for online fraud. The police investigation is continuing to establish the circumstances of the alleged scam and identify the person or persons responsible.