That Wedding Invitation File on WhatsApp Could Be a Virus: 7 Checks Before You Open It
A message arrives on WhatsApp with a cheerful note and a file named like a wedding card. You tap it out of habit, expecting a PDF or an image. Instead it asks to install an app, and that app quietly takes over your phone. This scam spreads fast during wedding season, and it is built to look like a harmless shaadi invite.
During wedding season, invitations fly around on WhatsApp all day, so a card from an unknown number does not feel strange. That is exactly why scammers use it. They send a file with a name like wedding-invitation or shaadi-card, often with a short friendly message asking you to come and bless the couple. The file is not a card at all. It is an Android app, an APK, and opening it installs software that can read your messages, steal the one-time passwords sent by your bank, and send money out of your accounts.
Police across several Indian states have warned about this exact trick, because it preys on politeness and curiosity rather than greed. You are not being offered a prize or threatened with arrest. You are simply being invited to a wedding, so your guard stays down. Here are seven checks before you open any invitation file you were not expecting.
The simple rule: A real wedding invite is a photo, a PDF, or a text message. It is never an app you have to install. If a card from WhatsApp ends in .apk or asks permission to install, delete it without opening it.
1. The file name ends in .apk
Look at the full file name before you tap. A genuine invitation arrives as a picture or a PDF, so it ends in .jpg, .png, or .pdf. The scam file ends in .apk, which is an Android app installer. Phones sometimes hide the ending, so if a wedding card shows an app-style icon rather than an image preview, treat it as dangerous. No wedding in the world sends its invitation as an app you must install.
2. It came from an unknown number
Most of these files come from a number you do not recognise, sometimes with a foreign country code. A real invite usually comes from someone you know, or at least someone who can tell you who they are. If a stranger sends you a wedding card, pause. Even a warm message like please join us for the celebration means nothing if you cannot place the sender. When in doubt, ask who they are before touching the file.
3. Opening it asks to install or allow unknown apps
The clearest warning is the prompt that appears when you tap. A real card just opens. The fake file instead asks you to install an application, or to allow installing apps from unknown sources. That request is the trap closing. The moment any invitation, delivery slip, or document asks for install permission, stop and back out. There is no safe reason for a greeting card to install software on your phone.
4. The app wants messages, contacts, and accessibility access
If it does install, the app demands sweeping permissions: your SMS messages, your contacts, and often accessibility access, which lets it read and control your screen. With your messages it can grab the OTPs your bank sends. With your contacts it can spread the same file to everyone you know. Nothing about viewing a wedding card needs any of this. Permissions far beyond the job are a sign the app exists to spy, not to inform.
5. Your phone starts behaving strangely
After installing, people often notice the screen flicker or go dark, the battery drain fast, data usage spike, or strange messages being sent from their number. Some victims find small unknown transactions, then larger ones. These are signs the app is working in the background, reading codes and moving money. If any of this starts right after you opened a file, disconnect the phone from the internet at once and begin cleaning it up.
6. There is no event detail you can verify
A real invitation names the couple, the families, a date, and a venue you can check. The scam message is vague on purpose, because the goal is only to get you to open the file. If the card has no names you recognise, no verifiable venue, and no way to confirm the event with a mutual friend or family member, there is nothing to attend. A wedding you cannot trace is not a wedding, it is bait.
7. You feel rushed to open it right now
Some versions add a nudge: the event is today, please confirm quickly, or kindly open and reply. That small pressure is there to stop you thinking. A genuine host will happily wait while you confirm who they are. If a message pushes you to open an unexpected file immediately, slow down. The urgency is not courtesy, it is the scam trying to beat your second thoughts.
What to do if you already installed it
Turn on airplane mode to cut the app off from the internet. Uninstall the suspicious app, and if it will not uninstall, restart the phone in safe mode and remove it there, or do a full backup-and-reset if needed. Call your bank through the number on your card to freeze transactions, then change your banking and UPI passwords and your OTP-linked accounts. Warn the contacts the app may have messaged, and report the fraud at the cyber helpline 1930 and cybercrime.gov.in as fast as you can.
The family rule for invitation files
Agree at home that nobody installs an app from a WhatsApp card, a delivery slip, or any document, no matter how festive it looks. This matters most for parents and elders, who get many forwards during wedding season and may tap first and ask later. Tell them plainly: real invitations are pictures or PDFs, and anything that asks to install is to be deleted and reported, not opened.
How FakeOut helps
Many of these scams also travel as convincing images: a forged invitation card, a fake payment confirmation, or a doctored screenshot meant to make the whole thing feel real. FakeOut helps you check whether an image or screenshot may have been manipulated before you trust it, act on it, or forward it to family who might tap without thinking.