# Wedding invitation APK scam: is that link safe?

By Zaroor Aana. Last updated 15 November 2026. Page: https://zarooraana.com/blog/wedding-invitation-apk-scam

> The wedding invitation APK scam is a fake wedding card sent on WhatsApp as a file ending in .apk. An APK is an Android app, not a card. Once installed it can read OTPs and reach bank accounts. A real invitation is an image, a PDF or a web page, and never asks you to install anything.

## In brief

- A file ending in .apk is an Android app, so a wedding card that arrives as an .apk file is not a wedding card.
- Police in Rajasthan, Himachal Pradesh and Maharashtra have all issued warnings about fake wedding invitations on WhatsApp.
- A genuine invitation is a picture, a PDF, a video or a link that opens as a web page, and it never asks for an install, an OTP or bank details.
- If you installed such a file, switch off mobile data and Wi-Fi, uninstall the app, change your passwords and UPI PIN, and report it on 1930 or cybercrime.gov.in.
- Hosts can help by sending the invitation from their own number, with the names and date in the message and a line saying it opens in the browser.

## What is the wedding invitation APK scam?

The wedding invitation APK scam is a message, usually on WhatsApp, that looks like a wedding invite but carries a file ending in .apk. APK stands for Android Package Kit. It is the file format of an Android app. Opening it does not show a card. It starts installing an app on the phone.

Rajasthan Police’s cybercrime branch described the pattern in April 2026: fraudsters send a file with a name like “marriage.apk”, and once it is installed they gain control of the phone, which lets them steal OTPs and reach bank accounts. Himachal Pradesh’s cyber police said in November 2025 that the malware can reach photos, contacts and financial information, and then sends the same fake invite to the victim’s contacts.

That last part is why the message often comes from someone you know. Rajasthan Police also warned that fraudsters sometimes take over a known contact’s account and message people from it. In one case reported from Bengaluru in 2026, a businessman who installed a fake wedding card lost about ₹5 lakh through unauthorised UPI transactions within minutes, according to the news report.

## Is it safe to open a wedding invitation link on WhatsApp?

A wedding invitation link that opens as an ordinary web page in your browser is a different thing from an .apk file. A web page can show a card, a map and a reply button without installing anything on the phone. Most families who send digital invitations send exactly this, and [a link has real advantages over a video or image](https://zarooraana.com/guides/wedding-invitation-video-or-link).

The simple rule: a real wedding invitation never asks you to install anything. If tapping the “card” brings up an install screen, a request to allow unknown apps, or a list of permissions, stop there. Rajasthan Police’s senior cybercrime officer put it plainly: a file ending in .apk is not an invitation card and should never be installed.

A link is not automatically safe either. The same advisory warns about links dressed up as invitations that ask for your mobile number and banking details, or that try to download harmful software in the background. A wedding invitation has no reason to ask for an OTP, a card number, a UPI PIN or a login. If a page asks for any of these, close it.

APK files are an Android matter, because APK is the Android app format. Phishing pages that ask for bank details can open on any phone, so the rule about never typing in bank details applies to everyone.

## How do you tell a real wedding invitation from a fake one?

**A real wedding invitation and a fake one, compared**

|   | Real invitation | Fake invitation |
| --- | --- | --- |
| What arrives | An image, a PDF, a video, or a link to a web page | A file ending in .apk, or a link that downloads one |
| What happens when you tap | The card opens in the chat or in your browser | The phone asks to install an app or allow unknown apps |
| What it asks for | At most, whether you are coming | Permissions, an OTP, bank or card details |
| The message | Names the couple, the date and the city, and greets you by name | Vague: “please check our wedding card”, with no names |
| The sender | Someone whose family wedding you already know about | An unknown number, or a contact who sounds unlike themselves |

Before you tap, run through this short check.

- Look at the file name. If it ends in .apk, do not open it. Himachal Pradesh’s cyber police note that genuine cards are normally shared as JPG images or PDF files, never as APK links.
- Read the message. Does it name the bride, the groom and a date? Do you know of a wedding in that family?
- Check the sender. If the number is unknown, or a known contact has sent something out of character, call them. Maharashtra Cyber Police’s advice is to confirm the invitation directly with the sender.
- Look at the link before tapping. Be careful with shortened links and with addresses that have spelling mistakes.
- Never install anything, and never enter an OTP or bank details, to view a card.

## What should you do if you already opened or installed the file?

If you only received the message, or tapped the file and then cancelled the install screen, the app was not installed. Delete the message, block the sender if it is an unknown number, and do not forward it.

If the app was installed, act quickly. India’s computer emergency response team, CERT-In, lists these steps in its alert on APK malware.

1. Switch off mobile data and Wi-Fi so the app cannot send anything out.
2. Go to Settings, then Apps, and uninstall the suspicious app straight away.
3. Run a scan with a trusted mobile antivirus. Google Play Protect, which is built into Android phones, also checks for harmful apps; keep it switched on.
4. Change your passwords and your UPI PIN.
5. Check your bank statements for transactions you did not make.
6. Report it on the cybercrime helpline 1930 or at cybercrime.gov.in.

It is also sensible to call your bank on its official number, ideally from another phone, and to tell your family and close contacts that messages from your number may not be from you. Keep a screenshot of the original message and the sender’s number for the complaint.

## Where do you report a wedding invitation scam in India?

Report a wedding invitation scam on the national cybercrime helpline, 1930, or on the National Cyber Crime Reporting Portal at [cybercrime.gov.in](https://cybercrime.gov.in). Both are listed by the Indian Cybercrime Coordination Centre (I4C), which works under the Ministry of Home Affairs. You can also go to your nearest police station or cyber cell.

If money has left your account, call 1930 first and then your bank. Do not wait to see whether more is taken. Have the transaction details, the time and the sender’s number ready.

## As a host, how do you make your genuine invite look trustworthy?

If you are the one sending invitations this season, some of your guests will be nervous, and elders most of all. A few habits make your genuine invite easy to trust.

- Send it yourself, from a number your guests already know. Parents send to relatives, the couple send to friends.
- Greet each guest by name and put the couple’s names, the date and the city in the message itself, not only behind the link.
- Say plainly how it opens: “It opens in your browser, there is nothing to download.”
- Never send your invitation as an app, and do not use a link shortener that hides the address.
- Call the elders after sending, and tell everyone they can ring you if they are unsure. Nobody should feel silly for checking.

> Namaste [Name] ji, we invite you and the family to [Bride] and [Groom]’s wedding on [Date] in [City]. The invitation is below. It opens in your browser, there is nothing to download or install. If you have any doubt, please call me. [Link]

There are more messages like this in [wedding invitation messages for WhatsApp](https://zarooraana.com/blog/wedding-invitation-message-for-whatsapp), and the sending steps are in [how to send a wedding invitation on WhatsApp](https://zarooraana.com/guides/how-to-send-wedding-invitation-on-whatsapp).

## How does a Zaroor Aana invite open?

A Zaroor Aana invite is a web page. It opens in the phone’s browser on zarooraana.com, with no app, no APK, no download and no login. The WhatsApp preview shows your names and says that it opens in the browser, so a cautious relative can see what it is before tapping.

You send it from your own WhatsApp, so guests hear from you and not from us. You can [open any design with sample names](https://zarooraana.com/invites) to see exactly what your guests would see.

## Questions families ask

### Wedding invitation APK kya hai?

Wedding invitation APK ek nakli shaadi ka card hai jo WhatsApp par .apk file ke roop mein aata hai. APK Android app ki file hoti hai, card nahi. Ise install karne par thag phone se OTP aur bank ki jaankari tak pahunch sakte hain. Aisi file kabhi install na karein.

### What happens if I only opened the message but did not install anything?

If you only read the message, or tapped the .apk file and cancelled when the phone asked to install it, the app was not installed. Delete the message, do not forward it, and block the sender if the number is unknown. Keep Google Play Protect switched on.

### Can a wedding invitation PDF or image be a scam?

Police advisories describe genuine wedding cards as JPG images or PDF files, and the fake ones as .apk files or suspicious links. Check the full file name before opening. A file called “wedding card.apk”, or one with .apk after another ending, is an app, whatever its icon looks like.

### Why did the fake wedding invitation come from someone I know?

Himachal Pradesh’s cyber police say the malware sends similar fake invites to the victim’s own contacts, and Rajasthan Police say fraudsters sometimes take over known contacts’ accounts. So a familiar name is not proof. If the message feels unlike them, call and ask.

### Is the wedding invitation APK scam a risk on iPhone?

APK is the Android app format, so the fake card file is aimed at Android phones. iPhone users should still be careful with links: police also warn about fake invitation links that ask for mobile and banking details, and those pages can open on any phone.

### What is the cybercrime helpline number in India?

The cybercrime helpline number in India is 1930, and complaints can also be filed online at cybercrime.gov.in, the National Cyber Crime Reporting Portal. Both are listed by the Indian Cybercrime Coordination Centre under the Ministry of Home Affairs.

### How do I know a digital wedding invitation link is genuine?

A genuine digital wedding invitation link comes from a number you know, sits under a message that names the couple and the date, and opens as a web page in your browser. It does not install anything and does not ask for an OTP, a login or bank details.

## See it for yourself

- [See the wedding invites](https://zarooraana.com/invites)
- [How to send it on WhatsApp](https://zarooraana.com/guides/how-to-send-wedding-invitation-on-whatsapp)
- [How ordering works](https://zarooraana.com/how-it-works)

## Sources

- [ThePrint (PTI), 25 April 2026: Rajasthan Police warns against scams through wedding invites on WhatsApp](https://theprint.in/india/rajasthan-police-warns-against-scams-through-wedding-invites-on-whatsapp/2914411/)
- [The Tribune, 28 November 2025: Invited to wedding? Police say check the link before you click](https://www.tribuneindia.com/news/himachal/invited-to-wedding-police-say-check-the-link-before-you-click)
- [The Free Press Journal, 24 December 2024: Maharashtra Cyber Police warn citizens of wedding invitation scam](https://www.freepressjournal.in/mumbai/maharashtra-cyber-police-warn-citizens-of-wedding-invitation-scam-leading-to-malware-financial-losses-check-details)
- [The Free Press Journal, 31 March 2026: CERT-In issues alert on APK malware fraud (precautions and steps after installing)](https://www.freepressjournal.in/mumbai/cert-in-issues-alert-on-apk-malware-fraud-used-by-cybercriminals-to-steal-financial-data-via-fake-e-challan-bill-alerts)
- [Indian Cybercrime Coordination Centre (I4C), Ministry of Home Affairs: report a cybercrime on 1930 or cybercrime.gov.in](https://i4c.mha.gov.in/)
- [Digit, updated 11 May 2026: fake WhatsApp wedding invite and a Bengaluru businessman](https://www.digit.in/news/apps/fake-whatsapp-wedding-invite-steals-rs-5-lakh-from-bengaluru-businessman-how-to-stay-safe.html)
- [Android Help: use Google Play Protect to help keep your apps safe](https://support.google.com/android/answer/2812853?hl=en)