Kerala Police have warned people searching online for hospital appointments after fraudsters began using fake contact numbers and malicious Android apps to reach patients. The scam starts with a Google search, shifts to a phone call or WhatsApp chat, and can end with OTPs or UPI access being exposed.
The warning, reported on September 20 and 21, 2026, is important because the hospital name is only the bait. A routine appointment search can become the first step in the attack before anything looks obviously suspicious. The wider tactic, persuading a user to install an APK file outside an official app store, has already appeared in other Indian cyber-fraud campaigns.
Key Highlights
- Fraudsters place or circulate fake hospital contact numbers that can appear in search results.
- Victims may receive an APK file on WhatsApp labelled as an appointment-booking app.
- Kerala Police say malicious apps can expose OTPs, payment information, and UPI access.
- People who lose money should quickly call 1930 and report the incident on cybercrime.gov.in.
How The Fake Hospital App Scam Works
According to the Kerala Police warning carried by the India Today report and The New Indian Express report, the target is usually someone looking for an OP appointment or a hospital phone number. After the victim calls a fake number, the person at the other end poses as hospital staff and sends an Android Package Kit, or APK, through WhatsApp.
The file may have a reassuring name linked to appointment booking. Once installed, however, it may seek access to SMS messages, notifications, contacts or phone functions. That can expose OTPs and other information used around digital payments. Police also warned that existing UPI apps could be misused or other payment apps could appear without the user knowingly installing them.
Why UPI Lite Raises The Risk
Kerala Police specifically flagged small unauthorised transactions. UPI Lite does not require a fresh UPI PIN for every eligible low-value payment, so repeated debits can be an early warning sign. Users should not dismiss unexpected payments below ₹1,000 simply because the amount looks small.
Is This New Cyber-Fraud Method Spreading?
The hospital theme looks like a fresh variation, but malicious files are not a new route into Indian phones and accounts. CERT-In has already warned Android users not to install APK files received through WhatsApp, SMS, Telegram, or random websites in connection with fake e-challan scams.
There is a broader pattern too. In August 2026, the Indian Cyber Crime Coordination Centre said malicious files disguised as account statements or RBI and MCA communications were being used in a “Boss Scam” campaign. I4C said more than 58,000 potential victims had been alerted in the preceding 30 days and over 10,000 people had been protected through blocking measures. The Ministry of Home Affairs advisory explains the campaign here.
That does not prove the hospital-app operation and those campaigns are run by the same people. It does show how attackers keep changing the story while preserving the same useful ingredients: urgency, impersonation, a trusted brand or institution, and a file the victim is pushed to open.
Official Kerala Police cyber-crime figures recorded 1,537 cyber cases up to July 2026. Separately, the Ministry of Home Affairs said 3,718 mobile apps, including fraudulent loan apps, had been blocked by I4C up to June 30, 2026. The government response is available here.
What Users Should Do Before And After Installing An APK
Hospital numbers should be checked on the institution’s official website or verified social account, not accepted simply because they appear high in search results. Apps should come from trusted app stores, and unfamiliar apps should not receive SMS, notification, contact or phone permissions.
Kerala Police’s Cyberwall service can also examine suspicious links, messages and APK files. Its public portal says people can submit APKs for malware inspection through supported channels.
If a suspicious APK has already been installed, disconnect mobile data and Wi-Fi first. CERT-In advises removing the suspicious app, checking bank activity, changing relevant passwords or UPI credentials, and scanning the device with trusted security software. For financial loss, call 1930 immediately and file a complaint through the National Cyber Crime Reporting Portal.
FAQs
What is the fake hospital app scam?
Fraudsters pose as hospital staff and send malicious APK files that compromise phones and payments.
Can an APK file steal an OTP?
A malicious APK may access SMS or notifications if dangerous permissions are granted during installation.
Should hospital apps arrive through WhatsApp?
Users should avoid installing hospital APK files received through WhatsApp unless verified through official channels.
What should I do after losing UPI money?
Call 1930 immediately, inform your bank or UPI provider, and report the fraud online promptly.
How can I verify a hospital contact number?
Check the hospital’s official website or verified social account before calling numbers shown in results.
Kerala Weather & Monsoon: What You Need to Know
Which Kerala Areas Face Rain Risks?
Check out the latest areas facing landslides and flash-flood risks.
Is Your Wayanad Travel Route Affected?
Find out how heavy rain may affect travel routes.
Which Districts Face Orange Alert?
Uncover the latest rain warnings for Kerala districts.
When Will Kerala Monsoon Bring Rain?
Browse the latest monsoon timings and Bengaluru traffic updates.
Are Nine Kerala Districts Under Alert?
See the affected districts and weekend travel updates.
