Kerala Police Issue Advisory Against Fake Hospital Appointment App Scam Targeting UPI Users
Kerala Police warned against a hospital appointment booking scam where fake search numbers lead to malicious WhatsApp APKs. Once installed, malware steals OTPs/data and misuses UPI/UPI Lite for micro-transactions under INR 1,000. Report fraud to 1930 or cybercrime.gov.in. Scroll below to know more.
The Keralam Police have issued a public advisory cautioning citizens against a rising financial fraud scheme involving malicious APK files distributed via WhatsApp under the guise of hospital outpatient appointment bookings. “Install apps only from trusted sources like Google Play Store and do not grant permissions for SMS, notifications, contacts or phone access to unfamiliar apps. If you suspect that a fake app has been installed, immediately disconnect the internet and contact your bank or UPI service provider to secure your account," the police said in the statement, reports PTI.
How the Fraud Works
The scam exploits routine digital searches for medical facility contact details:
- The Bait: Fraudsters manipulate or list fake phone numbers in online search results for major regional hospitals.
- The Hook: When victims call, scammers impersonate hospital desk staff and direct users to download a mobile app file via WhatsApp for appointment scheduling.
- The Compromise: Once installed, the malicious app grants attackers remote access to device data, SMS/OTPs, and existing UPI platforms (such as Google Pay or PhonePe). Scammers may also silently sideload unauthorised secondary payment tools.
- The Drain: Enabled features like UPI Lite bypass OTP requirements for small-ticket purchases, allowing fraudsters to siphon funds via micro-transactions under INR 1,000 that often go unnoticed by victims. Bangladeshi National Held at Kerala Naval Academy With Fake Indian Documents.
Preventive Measures and Best Practices
Police outlined baseline hygiene rules to mitigate exposure:
- Verify Contact Channels: Cross-check phone numbers found via search engines against official hospital domains or verified social handles.
- Block Sideloaded APKs: Never install .apk or application files received over WhatsApp for appointments, KYC updates, or refunds. Stick exclusively to official app stores like Google Play.
- Audit Permissions: Deny SMS, notification, contact, and telephony permissions to unverified or newly installed utilities.
- Emergency Action: If a fake app installation is suspected, sever internet connectivity immediately and notify your bank or payment provider.
Reporting and Helpline Information
Victims of the scam are advised to act promptly:
- Call the national cybercrime helpline at 1930.
- File a formal digital complaint via the official portal at cybercrime.gov.in.
With digital health service queries increasing across urban and regional centres, law enforcement stresses that basic procedural verification - such as avoiding unverified messaging links and auditing micro-transaction alerts - remains the primary defence against credential-stealing malware.
(The above story first appeared on LatestLY on Sep 21, 2026 09:25 AM IST. For more news and updates on politics, world, sports, entertainment and lifestyle, log on to our website latestly.com).
