Kerala Police have warned the public about a new financial fraud in which fake hospital appointment apps are used to steal OTPs and misuse UPI accounts. The scam targets people who search Google for hospital contact numbers, and it works through app files sent over WhatsApp.
Police issued the advisory on Sunday, September 20. It asks people to be vigilant against fake mobile apps aimed at those searching for outpatient appointments and contact details of leading hospitals in the state. Some outlets refer to the force as “Keralam Police”.
How the fake hospital app scam works
According to the police statement, fraudsters get fake phone numbers to appear in Google search results. When a person calls one of these numbers, the fraudster poses as hospital staff and sends an app file over WhatsApp, described as “hospital appointment booking” or something similar.
Once the app is installed, the phone is compromised. Police said confidential information, including OTPs, can be accessed, and UPI services may be misused, leading to unauthorised financial transactions. UPI apps such as PhonePe and Google Pay on the phone may be misused, and other payment apps may be installed without the user’s knowledge.
Police have not said Google is at fault. The advisory describes how fraudsters exploit search listings.
UPI Lite and small debits
Police also flagged UPI Lite, the on-device wallet for small payments. If it is enabled on a phone, an OTP is not needed for small-value transactions. Police urged people not to ignore repeated fraudulent debits of less than Rs 1,000, since small amounts can add up.
Police advice to the public
- Verify numbers found on Google through the hospital’s official website or verified social media pages.
- Do not install app files received through WhatsApp for purposes such as appointment booking, KYC or refunds, under any circumstances.
- Install apps only from trusted sources such as the Google Play Store.
- Do not grant SMS, notification, contacts or phone permissions to unfamiliar apps.
What to do if you installed a fake app
Police said anyone who suspects a fake app has been installed should disconnect the internet immediately and contact their bank or UPI service provider. Victims can file a complaint on the cyber helpline 1930 or at cybercrime.gov.in.
Part of a wider pattern of fake-app fraud
The warning follows other fake-app scams. In August, Kerala Police cautioned people about a fake app called NTL that lured victims with promises of high-income online jobs. In Bengaluru, a woman lost Rs 14.60 lakh in late 2025 after installing a fake Bescom bill app shared over WhatsApp, and the Indian Cyber Crime Coordination Centre (I4C) has warned about fraudulent Android apps advertised on social media to steal banking credentials.
What is not yet known
The advisory does not give the number of victims or the amount of money lost, and it does not name any hospital. This report will be updated if police release more details.
Quick safety checklist
- Check any hospital number against the official website before calling.
- Never install an app file sent on WhatsApp.
- Review your UPI transaction history for small debits you don’t recognise.
- If something goes wrong, disconnect the internet, call your bank and report on 1930.
With inputs from PTI and UNI.
Sources
- ThePrint/PTI: Keralam Police warn of fake hospital appointment apps used in financial fraud
- UNI: Police warn against fake APK scam targeting hospital appointment seekers
- LatestLY: Kerala Police issue advisory against fake hospital appointment app scam
- ThePrint/PTI: Kerala Police advise caution against fake online job app
- Deccan Herald: Bengaluru woman duped of Rs 14.60 lakh after downloading fake Bescom app
- MediaNama: I4C warning on scam app ads