Hidden SMS-forwarding app steals your bank OTPs without you ever seeing them
A malicious APK ('Expe App' or similar) once installed silently activates SMS message-forwarding on the victim's phone. Every bank OTP is forwarded to the attacker before the victim reads it, enabling account drains, FD liquidations, and NEFT transfers without the victim knowingly sharing any credential.
Also known as: Expe App OTP scam, SMS forwarding OTP theft India, OTP intercept malware APK India, FD broken without OTP shared
Already happened to you? Do this in the next few minutes
Call 1930 now- 1 Call 1930 — the national cyber-crime helpline — right now. The sooner you report, the better the chance of freezing the money before it moves.
- 2 Call your bank to freeze the account and block the card immediately. Use the number printed on your card, never a number from the message or caller.
- 3 File a report at cybercrime.gov.in and keep every message, screenshot, and transaction ID.
- ! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
What to do right now
- 1 Go to Settings → Apps → review every app with SMS read/send permissions; uninstall any unfamiliar app immediately
- 2 Call your bank's 24-hour helpline to freeze transactions if you suspect silent OTP forwarding; request an account statement to identify unauthorised debits
- 3 Change your UPI PIN, net banking password, and mobile banking PIN from a different clean device after uninstalling the suspicious app
- 4 Do not install any APK sent via WhatsApp, Telegram, or SMS — bank apps are distributed only through Google Play or the App Store, never as direct APK links
- 5 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
- 6 Report at https://cybercrime.gov.in or call 1930 (national cyber helpline).
Was remote-access software installed?
If a scammer asked you to install AnyDesk, TeamViewer, Quick Support, or any remote-access app, your device may still be compromised.
Run SeraphSecure to detect and remove it →Red flags
- ⚠ A utility, banking helper, or service APK received via WhatsApp link, SMS, or a third-party store — install only apps from Google Play or Apple App Store
- ⚠ Money disappears from your account or an FD is prematurely broken when you never shared the OTP with anyone — a silent SMS-forwarder may have intercepted it
- ⚠ An unfamiliar app on your phone has SMS or notification-access permissions — review App Permissions in Settings and revoke any you did not consciously grant
- ⚠ Your phone's data usage spikes unexpectedly — a forwarding app sends your incoming SMS messages to an external server
- ⚠ You receive fewer bank OTP SMSes than expected — the OTP may be arriving and being forwarded before you open the notification
Sources
- Amar Ujala / Varanasi Police — Expe App ₹116 Crore Cyber Scam Busted, Four Arrested Including Mastermind, 143 Complaints (August 23, 2026)
- Amar Ujala — No OTP Shared, No Password Given, Yet ₹5.50 Lakh Stolen After FD Was Broken: New Cyber Fraud Method (August 12, 2026)
- Varanasi Cyber Crime Cell — Joint Operation Busts Expe App OTP Theft Network (August 2026)