Fake DigiLocker apps are back — and this time they are draining bank accounts

Representative image

• Fake DigiLocker apps on Google Play are stealing user info and bank details
• These apps mimic official branding and ask for suspicious permissions
• Users should verify app publishers and avoid granting unnecessary permissions

Did our AI summary help?

If you search for “DigiLocker” on Google Play, you expect to see the government’s document wallet app. And you usually do. But mixed in with the real one, over the past few weeks, are apps that shouldn’t be there at all.

Security researchers and users have been flagging fake DigiLocker lookalikes that are doing the rounds again. These apps don’t store documents. They exist to steal information and move money out of bank accounts.

They look believable. They use the tricolour. They use the Ashoka Chakra. Their names are just close enough to the real one to pass at a glance. Some have racked up thousands of downloads. A few even have reviews that don’t immediately raise suspicion.

Only after you install them does the trouble start

Most of these apps begin by asking for permissions that make no sense for a document app. Access to SMS. Access to calls. Sometimes even screen recording. Then they ask you to “verify” yourself with your Aadhaar or PAN or phone number.

From there, things move quickly

Some versions quietly read your OTP messages. Others sit on top of your screen and record what you type. In a few cases, people have been pushed to fake UPI or banking pages that look almost exactly like the real ones. You think you’re logging in. You’re really handing over your details.

In several cases, people noticed money missing the same day. Sometimes within minutes.

What makes this scam work is not clever code. It’s trust

DigiLocker is a real, widely used government service. People don’t approach it with suspicion. And in 2026, when everything from EPF claims to KYC updates seems to require yet another app, more people are searching for these tools than ever.

This also doesn’t look like an old-style “you’ve been hacked” situation. There’s no scary message. No warning. Many people only realise something is wrong when they open their bank app and see a debit they don’t recognise.

There are ways to spot these fakes, but you have to slow down

The real DigiLocker app is published by the National e-Governance Division of the Government of India. The fake ones usually have slightly off names, strange developer accounts or email addresses that don’t look official.

Permissions are another giveaway. A document app does not need to read your SMS or see what’s on your screen. And DigiLocker will never ask for your UPI PIN or banking password.

If you think you may have installed one of these apps, don’t open it again. Switch off your internet. Uninstall it. Check your bank and UPI apps immediately.

Change your passwords from another device. Call your bank and report what’s happened. If money is gone, file a complaint on the cybercrime portal. Speed matters in these cases. The earlier you report it, the better the odds of stopping the damage.

As for how these apps keep getting through — Google does take them down. But the people behind them are fast. New versions appear under new names. Some stay up long enough to catch thousands of users before they’re removed.

This is the uncomfortable shift: even app stores can’t be treated as completely safe anymore

The bigger lesson here is simple. Digital scams no longer look shady. They look normal. They look official. They sit right next to the real apps you trust.

In 2026, being careful with links is not enough. You also have to be careful with what you install.

FAQs

1. Is the real DigiLocker app safe?

Yes. The real one is. The problem is fake apps pretending to be it. Always check that the developer is the Government of India or download it from the official DigiLocker site.

2. If money is stolen, will I get it back?

Sometimes. It depends on how fast you report it. The sooner you tell your bank, the better the chance of stopping or reversing the transaction.

3. Should I reset my phone?

If the app had deep access like screen control or SMS access, a factory reset is the safest option.