Check a job ID (Baca halaman ini dalam bahasa Indonesia)

APK files disguised as job documents: how the scam works and what to do

Written by KarirAman editorial team Approved by Kaiser Khan (editor), Updated

An APK file sent by chat can read your OTP codes and empty your bank account, warns OJK. Installed one? Go offline, call your bank and follow these steps.

Very high severity Usually arrives via: WhatsApp, Telegram, SMS, e-mail

Summary

  • OJK says a fake APK file that is downloaded and installed can take personal data and drain the victim's bank account.
  • The communications ministry explains the app asks for SMS access, letting scammers read mobile-banking OTP codes.
  • OJK and the communications ministry advise installing apps only from official app stores.
  • Applying for a job never requires you to install an app from a file sent by chat.
Show the full summaryShow less
On this page
  1. How does the APK files disguised as job applications or interview letters scam work?
  2. What are the warning signs of the APK files disguised as job applications or interview letters scam?
  3. How is the APK files disguised as job applications or interview letters scam different from a real vacancy?
  4. I have already been caught. What should I do now?
  5. What does an APK scam on WhatsApp look like?
  6. How can an APK file empty a bank account?
  7. What should I do if I installed a scam APK?

How does the APK files disguised as job applications or interview letters scam work?

The APK files disguised as job applications or interview letters scam usually runs in 5 steps. Any step that asks for money, personal data or a move to a chat app is the point to stop.

  1. Step 1 of 5: The scammer sends a convincing message, posing as a company, an official body or a courier, with a file attached.
  2. Step 2 of 5: The file looks like an important document but ends in .apk, the installer format for Android apps.
  3. Step 3 of 5: Once installed, the app asks for SMS access and other phone permissions.
  4. Step 4 of 5: The scammer reads OTP codes arriving by SMS and uses them to get into the victim's mobile banking.
  5. Step 5 of 5: The account is drained, or the WhatsApp account is hijacked to scam the victim's contacts.

What are the warning signs of the APK files disguised as job applications or interview letters scam?

The APK files disguised as job applications or interview letters scam has the 5 main warning signs below, each with its source. One sign is enough reason to stop and check again before you pay or send any data.

  • The file you receive ends in .apk and is dressed up as an important document.
  • You are asked to install an app from a file sent to you, not from the Play Store or App Store.CNN Indonesia (official statement via media)
  • The installed app asks for access to SMS or notifications.Bank Muamalat Indonesia
  • The message comes from an unknown number or e-mail claiming to be official.
  • The sender makes it sound urgent so you open the file at once.Otoritas Jasa Keuangan (Sekretariat Satgas PASTI)

How is the APK files disguised as job applications or interview letters scam different from a real vacancy?

The table compares each step of the APK files disguised as job applications or interview letters scam with how legitimate employers recruit, row by row.

Scam tactics compared with legitimate recruitment practice
Scam tacticLegitimate practice
An application form or interview letter arrives as an .apk file by chat.Forms arrive as ordinary documents or are filled in on the company's official website.
You are asked to install an app outside the official app stores.Official apps are installed from Google Play Store or App Store.
The app asks for SMS access or your OTP codes.Applying for a job never needs access to your SMS, OTP codes or mobile banking.

I have already been caught. What should I do now?

If you have followed the APK files disguised as job applications or interview letters scam, stop all contact, send no more money or data, keep every piece of evidence, then report to the official channels below.

  1. If you have not opened the file, delete it and block the sender.
  2. If the app is installed, switch off your internet connection and delete the app.
  3. Change important passwords from another device and call your bank on the official number on your card or app.
  4. If money has gone, report to IASC and make a police report at the nearest SPKT desk.

Where should I report?

  • Indonesia Anti-Scam Centre (IASC)

    Report fraud after money was transferred, so the scammer's account can be blocked

    157WhatsApp 081157157157 iasc.ojk.go.id

  • Police call centre 110

    Emergencies and crime reports; formal reports are made at the SPKT of the nearest Polres or Polsek

    110 polri.go.id

Check a similar message with the job checker

What does an APK scam on WhatsApp look like?

The example below is an illustration written by the KarirAman editors from the pattern described by OJK and the communications ministry. It is not a copy of a real message. Names and numbers are hidden.

Good afternoon, this is the recruitment department of [name removed]. Here is your interview invitation; please open and complete it today: Interview_Invitation.apk. Info: 08xx-xxxx-xxxx.

The file name may sound official, but the .apk ending means it installs an app. The job checker marks messages with APK files as high risk.

How can an APK file empty a bank account?

The communications ministry explains that once installed, the fake app asks for SMS access. With that access the scammer can read the OTP codes your bank sends by SMS and log into your mobile banking. OJK says such files can take personal data and drain accounts, so both advise installing apps only from official app stores.

What should I do if I installed a scam APK?

Switch off the internet connection, delete the app, then change important passwords from another device and call your bank on its official number. These steps follow a bank's guidance to its customers. If money has already gone, follow the steps for people who sent money to a job scammer and report to IASC and the police.

Which careers are used as bait for the APK files disguised as job applications or interview letters scam?

Vacancies for these careers are often used as bait for the APK files disguised as job applications or interview letters scam, highest scam risk first.

KarirAman is 100% free. We never ask for money.

For job seekers and employers. We run no ads, sell no data and never ask for any fee. Anyone asking for money in KarirAman's name is a scammer. Our no-fee policy

Frequently asked questions

What is an APK file and why is it dangerous?

An APK is an Android app installer file. According to OJK, a fake APK that is downloaded and installed can take personal data and drain a bank account. The communications ministry explains that the app asks for SMS access, so the scammer can read OTP codes and get into mobile banking.

I only downloaded the file and did not install it. Am I safe?

OJK's warning describes the danger once the file is downloaded and installed. Delete the file without opening it, block the sender, and do not follow any request to install an app from outside the official app stores.

What if my WhatsApp account has been taken over?

Bank Muamalat warns that malicious apps can take over WhatsApp accounts. Tell your family and contacts through another channel not to answer money requests from your account, change important passwords from another device, and report to the police if you lost money.

Can an APK scam happen on an iPhone?

According to the official Android documentation, an .apk file is the package Android devices use to install an app, so APK scams target Android users. iPhone users still need to be careful, because other tricks, such as fake links asking for personal data or OTP codes, do not depend on the type of phone. OJK warns never to share OTP codes, PINs or passwords with anyone.

Is the APK trick the same as fake wedding invitations or parcel receipts?

The pattern is the same: an APK file disguised as an important document. In 2023 Indonesia's police cybercrime unit (Bareskrim) investigated fraud using wedding invitations sent as APK files on WhatsApp, and banks also warn about APKs disguised as delivery receipts. A fake job invitation letter is just another form of the same trick.

Who wrote and reviewed this page?

Written by KarirAman editorial team Published Updated

Prepared with AI assistance. Checked against official sources and approved for publication by Kaiser Khan (editor). Approval date: .

Sources

The facts on this page come from these sources. Dates show when we opened them.

  1. Waspada Modus Penipuan File APK PPS Pemilu yang Bisa Kuras Rekening CNN Indonesia · official statement via media · accessed
  2. Marak Penipuan Berkedok File APK, Ini Risiko dan Langkah Pencegahannya Bank Muamalat Indonesia · third party · accessed
  3. Waspada, Penipuan (Scam) Mengintai Kita. Ayo Lawan dan Hindari! (Booklet Satgas PASTI) Otoritas Jasa Keuangan (Sekretariat Satgas PASTI) · accessed
  4. Indonesia Anti-Scam Centre (IASC): Tentang, Langkah Pelaporan dan FAQ Otoritas Jasa Keuangan (IASC) · accessed
  5. Sentra Pelayanan Kepolisian Terpadu (SPKT) Kepolisian Negara Republik Indonesia · accessed
  6. Application fundamentals (Android Developers) Google, Android Developers documentation · accessed
  7. Bareskrim selidik penipuan berkedok undangan nikah ANTARA News Bali · official statement via media · accessed
How to cite

KarirAman (2026). APK files disguised as job documents: how the scam works and what to do. Updated 8 October 2026. https://kariraman.com/en/job-scams/apk-file-job-scams/

Save this page

Report a fake job Report a data problem How we handle corrections

CariTalent and PanduanHewan are Kode Nirlaba projects; Panduan Warga and The Cast Index are independent publications with the same founder. CourseToJob is a study-guide site with the same owner, run by Elite Digital AI Solutions Ltd.

Change log
  • : Added answers for iPhone users, the same trick using wedding invitations and parcel receipts, and what to do once installed.