All about the 'wedding invitation' scam on WhatsApp that can get your phone hacked

The hackers will get into the phone after the APK file is downloaded. (Representational)

Cybercriminals have begun using fake wedding invitations on WhatsApp to infiltrate personal devices across India. The scam, primarily targeting unsuspecting users with malicious APK files disguised as wedding invites, has sparked fresh warnings from law enforcement, with Himachal Pradesh Cyber Police leading the charge after a spike in cases in the state.

Cyber experts and police officials caution that these messages arrive from unknown numbers, appearing as innocent wedding invitations but concealing dangerous software. Once a user downloads the attachment, malware silently installs on their device, enabling cybercriminals to monitor activities, access sensitive data, and even exploit financial information.

“If you receive an unsolicited wedding invitation or any file from an unknown number, do not click on it. Ensure you verify the sender and the file before downloading anything onto your phone," warned DIG Mohit Chawla, from Himachal Pradesh’s CID and Cyber Crime Department.

How the Scam Unfolds

The fake invitation scam unfolds in a deceptively simple yet highly effective manner. Victims receive a WhatsApp message with an attachment labelled as a wedding invite. Once downloaded, the APK file automatically installs a malicious app on the user’s device, often without noticeable signs. From that point, hackers can take full control of the infected phone, using it to send messages, steal data, or even engage in financial extortion without the victim's knowledge.

The Himachal Pradesh Cyber Police have issued a state-wide advisory, urging residents to be vigilant when receiving files from unknown numbers, especially APK files.

In India, cybersecurity laws under the Information Technology (IT) Act, 2000, address the growing problem of online fraud, data breaches, and malicious cyber activities. Section 66D of the IT Act specifically covers cheating by impersonation using computer resources, making such scams punishable by imprisonment of up to three years, along with fines.

Victims of such cyber scams can lodge a complaint with the local cyber cell or report incidents on the National Cyber Crime Reporting Portal (cybercrime.gov.in). The process involves detailing the incident, including screenshots, transaction details, or other relevant information.

Tips for Staying Safe

Given the rise of online scams, experts recommend several measures to safeguard personal data:

1. Avoid APK Files: Avoid downloading APK files from untrusted sources, as they are commonly used for malicious purposes.

2. Verify Contacts: Be wary of unsolicited messages, even from known contacts, and verify unusual attachments before opening them.

3. Enable Security Settings: Install reliable anti-virus software and enable security settings that prevent installations from unknown sources.