A scam that robs money by luring people to download an Android app.

The Sri Lanka Police has uncovered information about a new cybercrime targeting Sri Lankan smartphone users, which involves stealing money from bank accounts. This digital scam primarily operates through ".apk" (Android Package Kit) files exchanged via popular social media applications like WhatsApp and Telegram.

Here, scammers send these malicious files not only from unknown numbers but sometimes even in the name of your friends. In many instances, these files appear as attractive or important documents like wedding invitations, electricity bills, or lottery draws, deceiving users into opening them as if they were photos or PDF documents. However, since an .apk file is a setup file for installing applications (Apps) on Android phones, clicking on it immediately and stealthily installs the relevant malicious application on your phone.

Once the application is installed, hackers gain complete control of your mobile phone, allowing them to read your short messages (SMS). The most dangerous aspect of this is that even confidential OTP codes related to your bank accounts fall into the hands of hackers without your knowledge, enabling them to easily steal money from your bank accounts.

To avoid this risk, the police strongly advise the public to completely refrain from downloading or opening any suspicious .apk files, regardless of the sender. When obtaining applications for mobile phones, only official sources such as Google Play Store or Apple App Store should always be used, and it is also mandatory to disable the "Install Unknown Apps" feature in the phone's settings.

The police further emphasize that if you have already fallen victim to this scam, you should immediately take steps to suspend your bank accounts and then report the incident to the nearest police station or the Computer Crime Investigation Division of the Criminal Investigation Department.