Credit Card Reward Points APK Scam

A message says your credit card reward points will expire today and links to an app. The app reads your SMS and steals OTPs from your phone.

A text says that reward points worth several thousand rupees will expire today and that you can redeem them by installing the bank's app from a link. The app is not from a store. Once installed it asks for permission to read your messages, and with that it can read bank OTPs as they arrive, which a scammer then uses to approve payments on your card.

How the scam works

The scammer sends a message in the name of a bank with a points amount, such as 9,850 reward points worth Rs 9,850, and a deadline of the same day. The message includes a link ending in a file for installation. Because you may really have points, the text feels close to a real reminder, and the amount is large enough to make you tap quickly.

The link downloads an installation file and the phone shows a warning about installing from an unknown source. The page tells you to allow it, so that you can claim your points. After install, the app asks for access to messages, calls and notifications, which it says are needed to verify your card. It then asks for your card number, expiry and mobile number.

With message access, the app forwards bank OTPs to the scammer. The scammer uses your card details to make online purchases or to move money, and the OTPs arrive in time. You may see only a flood of alerts or nothing at all if the app hides messages. The app may stay on your phone and keep reading new messages until you remove it.

An example of what you may see

Example only: 'Dear customer, your credit card reward points of Rs 9,850 will expire today. Redeem now by installing our rewards app from the link below. Allow all permissions to complete verification. Enter your card number and mobile number to claim. Offer ends at 11.59 pm.' The link ends in a file name and does not point to an official store page, and the app asks for permission to read all your messages.

This example is written for illustration. Real messages change their wording, names and links all the time.

Red flags

• Reward points are said to expire today.
• You are told to install an app from a link.
• The phone warns about installing from an unknown source.
• The app asks to read your SMS and calls.
• The app asks for card number and mobile number together.
• The link ends in a file name and is not from a store.

What to do right now

1. Do not install the app and do not tap the link.
2. Check your points inside your bank's official app downloaded from a store.
3. Never allow SMS access to an app you do not trust.
4. Delete the message and report it to your bank.
5. Report the sender on the Sanchar Saathi portal.

If you already paid or shared a code

1. Uninstall the app, restart the phone and change banking passwords from a safe device.
2. Call your bank on the number on your card and block the card.
3. Call 1930 and give the transaction details and time.
4. Report at https://cybercrime.gov.in with the message and app name.

National Cyber Crime Helpline: 1930. Report online at cybercrime.gov.in. Do it fast: the sooner your bank is told, the better the chance that money can be held.

Where this scam shows up

Read how it looks on each channel:

How Safeavio helps

Safeavio's phone scan reviews installed apps and permissions and points out apps outside a store, apps that look like copies of other apps and risky settings such as unknown sources, which can help you find an app like this. The link check and scam check can review the message first. Safeavio does not remove malware by itself, so follow the steps it shows.

• Phone health checks
• Phishing checks

Questions people ask

Other scams in this group

Also known as: reward points expiring SMS, credit card points redeem app fraud, card reward APK malware. More bank and card fraud