SBI YONO Aadhaar APK Scam: What to Do If You Downloaded or Installed It

The SBI YONO Aadhaar APK scam uses a fake account-blocking message to persuade customers to install an unsafe Android application file. The claim that YONO will be blocked unless Aadhaar is updated through an APK is fake. Do not install an APK received through SMS, WhatsApp, email or an unknown website.

The correct response depends on what happened. Receiving the message is different from downloading the file, installing it, granting dangerous permissions, entering banking details or losing money.

Is the SBI YONO Aadhaar update message genuine?

No. The government has refuted the message claiming that customers must install an APK to update Aadhaar or prevent YONO from being blocked.

SBI advises customers to avoid unknown applications and suspicious links. A genuine-looking logo, profile picture, sender name or urgent deadline does not prove that a message came from the bank.

Fraudsters commonly claim that an account, card, KYC status or mobile-banking service will be suspended unless the user acts immediately.

Identify your exposure before taking action

Stage 1: message received but nothing was clicked

• Do not open the link, APK attachment or QR code.
• Do not reply or call a telephone number shown in the message.
• Take a screenshot that includes the sender, number, date and complete message.
• Report the suspicious material to report.phishing@sbi.co.in.
• Verify any warning only through the official YONO application, SBI Internet Banking or SBI’s official website.
• Delete the message after preserving the evidence.

Stage 2: APK downloaded but not installed

Downloading an APK is not the same as installing or running it. The exposure is generally lower when the file was never opened, but the file should not remain on the phone.

A factory reset is not normally justified merely because an APK was downloaded but never opened or installed. The response should match the actual exposure.

Stage 3: APK installed or permissions granted

Treat the phone as potentially compromised. A malicious application may abuse legitimate Android features to read notifications, display a fake login page, intercept messages, capture the screen or control parts of the device.

Which Android permissions should be checked?

Stage 4: credentials entered, OTP exposed or money lost

This is a financial-emergency stage. Early reporting may improve the chance of restricting further transactions and tracing transferred funds.

1. Contact SBI’s unauthorised-transaction helpline immediately.
2. Ask SBI to restrict digital access and block affected cards where required.
3. Call 1930 for financial cyber fraud.
4. Submit a complaint through the National Cyber Crime Reporting Portal.
5. Report the transaction through SBI’s official grievance channel or branch.
6. Change banking, email and linked-account passwords from a clean device.
7. Contact the mobile operator if SIM compromise or unexpected loss of mobile service is suspected.
8. Preserve transaction IDs, beneficiary information, messages, telephone numbers, screenshots and complaint acknowledgements.

Official SBI reporting contacts

Use numbers and links published on SBI’s official website. Do not use a customer-care number embedded in the suspicious message, an advertisement, a social-media reply or an unofficial website.

How to report the fake message to SBI

• Forward the original email where possible, including its headers.
• For SMS or WhatsApp, attach screenshots showing the sender and complete message.
• Include the suspicious URL or filename without reopening it.
• State whether the file was only received, downloaded, installed or used.
• State whether banking information, Aadhaar details, PINs or OTPs were entered.
• Do not include passwords, PINs, OTPs or the full account number in an ordinary email.

How to block an SBI debit card

SBI’s published phishing guidance says a customer can block a debit card through the official YONO application or by sending BLOCK XXXX to 567676 from the registered mobile number, where XXXX represents the final four digits of the card.

Blocking the debit card does not automatically secure Internet Banking, email, UPI access or a compromised phone. Follow any additional restrictions advised by SBI.

Will SBI refund money lost through the fake APK?

No universal refund promise can be made. The result may depend on how the compromise occurred, whether confidential information was shared, how quickly the incident was reported and what SBI establishes during its investigation.

Ask SBI to record the exact complaint time and retain all acknowledgement numbers. The reporting timeline may later become relevant.

What remains unconfirmed?

• whether all circulating scam messages use the same APK filename;
• whether every APK variant requests the same Android permissions;
• whether all files belong to the same malware family;
• whether a particular phone was compromised when the file was opened;
• whether uninstalling removed every malicious component;
• whether SBI will restrict the entire account or only selected services;
• whether a disputed transaction will be reimbursed;
• how long the bank or cybercrime investigation will take.

Frequently asked questions