Someone in your WhatsApp group just sent you an APK file. It claims to be a free cricket scoring app, or maybe a wallet top-up tool. You tap the file, and Android asks you to approve a list of permissions before it installs. Most people scroll past this screen without reading a single line.
That one habit of skipping the permissions screen is how phones across India get compromised. This guide shows you exactly what to look for, what the red flags are, and how to decide whether an APK is safe to install.
What Is an APK and Why Do Permissions Matter?
An APK Android Package Kit is basically the installer file for any Android app. Think of it like the CD or .exe file people used to use on computers. When you download an app from the Play Store, Android installs the APK silently in the background. When you get the APK directly from a website or WhatsApp, you install it yourself.
Every APK contains a file called the AndroidManifest.xml. This file tells Android which parts of your phone the app wants to access. These are the permissions. Some are harmless, like checking your internet connection. Others, called dangerous permissions, can access your contacts, camera, microphone, location, or SMS messages.
The reason this matters for Indian users is straightforward. UPI payments, Aadhaar-linked apps, and mobile banking are part of daily life. A malicious APK that gets your SMS access can intercept OTPs and drain your bank account without you knowing.
What India’s Cybercrime Authority Has Said About APK Fraud
In August 2025, the Indian Cyber Crime Coordination Centre I4C under the Ministry of Home Affairs issued an advisory warning citizens about malicious Android apps being promoted through social media advertisements. Users were redirected from these ads to external websites and asked to download APK files from outside the Google Play Store.
The advisory, numbered TAU/ADV/018 and dated August 26, 2025, identified several suspicious apps including Night Play, Reloop, Kyss, Vimo, Rivo, Nexo and Vixa. The I4C warned that once installed, these apps request Accessibility permissions, which can allow attackers to monitor your screen, capture banking credentials, intercept OTPs, and carry out unauthorised transactions.
The malicious apps could steal banking credentials, take control of users’ devices, and transfer money from accounts without the user’s knowledge. Meta later removed 39 ads from Facebook and Instagram that were used to spread these APKs.
This is not a rare or unlikely risk. It is an active, organised fraud campaign targeting ordinary Android users in India.
How to Review App Permissions Before Installing an APK
Step 1: Open the APK file and read the permission screen
When you tap an APK file to install it, Android will show you a screen listing the permissions the app is requesting. Do not tap Install immediately. Take 30 seconds to actually read this list.
On Android 8.0 and above which is most phones sold in India since 2018, you will also see a prompt asking you to allow Install Unknown Apps specifically for the app or browser you are using to open the file. This is safer than older Android versions, where a single toggle would allow all third-party installs.
Step 2: Match each permission to the app’s actual purpose
This is the most useful test you can apply. Ask yourself does this app actually need this permission to do what it claims to do?
A simple photo editor asking for camera and gallery access makes sense. A PDF reader asking for the same does not. A food delivery tracker asking for location is reasonable. A calculator app asking for location and microphone access is a serious warning sign.
Here is a quick reference table for common permissions and when they should raise a question:
| Permission | Reasonable for | Question it if asked by |
|---|---|---|
| Camera | Photo/video apps, QR scanner, video calls | Calculator, simple game, PDF reader |
| Read SMS | Banking OTP apps with explicit reason | Entertainment, news, or casual games |
| Microphone | Voice call, recording, speech-to-text | Shopping tracker, weather app |
| Contacts | Messaging, caller ID apps | Simple utilities, games |
| Accessibility | Screen readers for disabled users | Any app with no disability-related feature |
| Exact Location | Maps, cab booking, food delivery | Flashlight, alarm clock, basic finance tool |
Step 3: Pay special attention to these two permissions
Accessibility permission is the most dangerous one to grant to an unknown app. Once an app holds accessibility permissions, it can gain extensive control over your device. The I4C advisory specifically warned Indian users never to grant Accessibility permissions to suspicious applications. If an APK you downloaded from a website or received on WhatsApp asks for this, delete the file immediately.
Install Other Apps permission technically REQUEST_INSTALL_PACKAGES in Android allows an app to silently download and install other APKs on your phone. A legitimate app rarely needs this unless it is a browser or a file manager. If a cricket app or a wallet tool is asking for this, treat it as a major red flag.
Step 4: Check the source before you even open the file
Reviewing permissions is only one part of a safe APK check. If the APK came from a random website, a WhatsApp forward, or an ad you saw on Instagram, stop there.
Scammers in India are sending fake APK files on WhatsApp dressed up as bank updates, India Post parcel trackers, KYC apps, and even wedding invitations. If a stranger or even a known contact sends you an APK file, do not install it.
The official app for any legitimate product, such as a fantasy sports platform, a lotus365 win experience, or a banking service, will always be downloadable from its official verified website or from the Play Store. If you are looking for an app related to gaming or sports platforms like lotus365 india, confirm the URL carefully before downloading any APK. Scammers build look-alike websites with near-identical domain names to trick users.
Step 5: Scan the APK file before installing
Before you tap Install, run the file through Google Play Protect if it is enabled on your phone, or a trusted Indian security app. Quick Heal Mobile Security is designed specifically for Android users in India. It automatically scans new APKs, warns about risky permissions, and blocks unsafe apps.
You can also use VirusTotal, a free online tool from Google, to upload the APK file and check it against dozens of security databases. Go to virustotal.com and upload the file before you install it.
Step 6: Review permissions again after installation
Even if you installed an APK and everything looks normal, open Settings on your phone and do this check.
Go to Settings > Apps > (your app name) > Permissions. You will see which permissions have been granted. If you see something enabled that you do not remember approving, or something that does not match the app’s purpose, turn it off. Android 6.0 and above lets you deny individual permissions, and the app will often still work for its core features.
Numbers Worth Knowing
According to a 2024 report by Avast and Comparitech, communication apps in India average 14.5 dangerous permissions per app, finance apps average 12.5, and shopping apps demand around 10.8 dangerous permissions. Indian apps also, on average, seek 3.5 times more dangerous permissions than apps in the US, according to the same data.
This does not mean every Indian app is unsafe. Many of these permissions are requested for legitimate reasons. But it does mean Indian users must be more careful than average about reading what they are approving.
A Note on Gambling and Betting Apps
If you are downloading a real-money gaming or betting APK, be aware that most such apps are not available on the Play Store due to Google’s policies. This means you will almost always be installing an APK from a third-party website. The permission review steps in this article are especially important in that situation. Before installing, verify the website URL carefully, check whether the app’s permissions match its stated features, and make sure Play Protect is running. Never share your banking credentials or OTP with any app you have not confirmed through its official channel.