Wedding invitation scam on WhatsApp: the short answer
A real wedding invitation on WhatsApp is a photo, a PDF or a web link. The wedding invitation scam sends a file that is an Android app (an APK) dressed up as a card. You can tell them apart before you tap: a photo shows the card right inside the chat, a PDF usually shows a small picture of its first page with a page count, and an APK shows a plain file icon with the letters APK and no picture at all. If you tap it anyway, Android still stops it up to three more times before it can do harm. Each of those warnings is a place to stop, and a genuine card never triggers any of them.
Below are the four warnings, the file name tricks, what to do if you already tapped, and how to send your own card safely. If you are the one sending cards this season, our free PDF to JPG converter turns a designer's PDF card into a photo that previews in the chat.
Why fake invites spike in November
In much of North and Central India the wedding season restarts after Dev Uthani Ekadashi, which falls on 20 November 2026. Families send dozens of digital cards in a few weeks, guests get them from numbers they half recognise, and few people think twice about opening one.
The pattern is well documented. In June 2025 CERT-In, India's national computer emergency team, published an alert about SpyMax, an Android spying app spread as a "wedding invitation" APK on WhatsApp. In November 2025 the Himachal Pradesh cyber crime police repeated the warning during that season, and Rohit Malpani, Superintendent of Police (Cyber Crime), said genuine cards are normally shared as JPG images or PDF files and never as APK links. The same lure has turned up with fake traffic challans and government scheme notices, so the checks below work for those too.
The sender is what catches careful people out. Police say the malware sends the same fake card to the victim's own contacts. So the file often arrives from a cousin, a colleague or a family group, from a number you have saved, and it carries their name and maybe a photo. A familiar name only tells you whose phone sent the file, and that phone may no longer be under their control.
What the fake invite file actually is
An APK (Android Package) is the file format Android uses to install apps. Apps from the Play Store are installed for you, so most people never see an APK. When one arrives in a chat, it is an app asking to be installed from outside the store.
CERT-In's alert lists what the SpyMax wedding app asks for once installed: access to Accessibility, access to your notifications, access to SMS, permission to install other apps, and to be set as your phone's home screen app. With those it can read what is on your screen, collect your messages, contacts and the one-time passwords (OTPs) your bank sends, record what you type, hide its own icon from the app drawer and download more malicious code. With your OTPs and messages in hand, someone can move money out of your accounts or take over your WhatsApp.
A wedding card only has to be looked at. It has no use for your SMS or your screen, so an invite that asks for either is fake.
The four warnings a fake invite has to get past
Most advice stops at "don't download APK files". That is right, but it gives you only one chance to notice. In practice a fake invite has to get past several separate checks, and the scammers' instructions are mostly about talking you through them.
| Step | What you see | What a real invite does |
|---|---|---|
| 1. The chat bubble | A plain file icon, the label APK, a size, and no picture of the card | A photo shows the card. A PDF shows its first page and a page count |
| 2. Install unknown apps | Android says it can't install apps from WhatsApp and offers a Settings button with a switch to allow it | Opens in your gallery or PDF viewer. Settings never appear |
| 3. Play Protect | The install may be blocked as unsafe, or you are told to switch Play Protect off | Nothing is installed, so Play Protect has nothing to check |
| 4. Restricted setting | The new app asks for Accessibility or notification access, and Android greys it out until you allow restricted settings | A card asks for no permissions at all |
1. The chat bubble shows the file type
WhatsApp picks the icon for a document from its real file extension. Before you tap, look at the small line under the file name. A PDF usually shows a preview of its first page and says something like "2 pages, PDF". An APK has no preview and is labelled APK. On an iPhone an APK cannot be installed at all, so iPhone users mostly see this scam as a link that leads to a fake login page instead.
2. Android asks before WhatsApp may install apps
Since Android 8, every app needs your separate permission to install other apps. The first time an APK is opened from WhatsApp, Android stops and says, in words that vary a little by phone, that it isn't allowed to install unknown apps from this source. It then offers a Settings button with a switch called "Allow from this source". A wedding card has no reason to send you into Settings.
That switch stays on after you flip it. If you allowed WhatsApp once, months ago, for some other file, the next APK from WhatsApp skips this warning entirely. Step 5 of the checklist further down shows how to turn it off again.
3. Play Protect may block it outright
Since late 2024 Google has run extra fraud protection in India, first announced as a pilot in October that year. When you try to install an app that came from a browser, a messaging app or a file manager, and that app asks to read SMS, read notifications or use Accessibility, Play Protect blocks the install and explains why. Google introduced it because, in its analysis, more than 95 percent of installs of the major fraud malware families that abuse these permissions came from these sources.
That is why scam messages sometimes include instructions such as "if it says blocked, turn off Play Protect and try again". No real invitation or bank will ever ask you to do that.
4. Accessibility is locked for apps from outside the store
On Android 13 and later, an app installed from a downloaded file can't simply be given Accessibility or notification access. The switch is greyed out, and tapping it shows a message that the setting is restricted. To get past it you have to open the app's info page, tap the three dots and choose "Allow restricted settings". Google's own help page says not to do this unless you trust the app's developer, because Accessibility lets an app read your screen and act on your behalf.
If anything that came to you as an "invitation" ever leads you to that menu, close it. The scam needs Accessibility to work, and this is the last screen where you can deny it.
When the file name says PDF but the file is an app
Scammers know people read the name and skip the label, so they make the name lie. The simplest trick is a double extension, such as Wedding_Card.pdf.apk. On a narrow phone screen the end of a long name can be cut off, and you see only "Wedding_Card.pdf…".
A sneakier trick uses an invisible Unicode character called the right-to-left override (U+202E). Everything after it is drawn backwards. A file really named Wedding_Card_ + U+202E + fdp.apk is displayed as "Wedding_Card_kpa.pdf", which looks like a PDF with an odd word before the extension. The real extension is still .apk, so the type label and icon still say APK. The same character has been used to disguise links in messages, which security researchers demonstrated against several chat apps in 2022.
So trust the type label and the preview, and ignore the name. If you can copy the file name or a link as text, for example from the rename box in your phone's Files app or from the message itself, paste it into our AI Text Cleaner and turn on "Show hidden characters". It marks a right-to-left override as U+202E, and the cleaned version shows the name in its real order. Our guide to hidden characters in text explains the rest of these invisible characters.
Already tapped the invite? Do these in order
If you installed the file, or are not sure what happened after you tapped it, work through this list. Settings menus differ between phone brands, so each step gives the words to type into the search bar at the top of your Settings app.
- Turn on airplane mode, and turn Wi-Fi off too. This stops the app sending anything out and stops new OTPs arriving on this phone while you work.
- From a different phone, call your bank's customer care and ask them to block net banking, UPI and cards for now. Then call 1930, the national cyber crime helpline, or report at cybercrime.gov.in. Reporting quickly gives the bank the best chance of holding money that has already moved.
- Search Settings for "See all apps" or "Apps" and look for anything installed today with a name or icon you don't recognise. The app may hide its icon from your home screen, but it still appears in this list.
- Before uninstalling, take its powers away. Search for "Device admin apps" and switch the unknown app off. Search for "Accessibility" and turn off any service you didn't add yourself. Search for "Notification access" and do the same. Search for "Default home app" and pick your phone's usual one again. Then uninstall the app. An app that is still a device admin often can't be uninstalled, which is why this step comes first.
- Search for "Install unknown apps" and turn the switch off for WhatsApp, your Files app, Chrome and anything else that doesn't need it.
- Open the Play Store, tap your profile picture, open Play Protect and run a scan.
- In WhatsApp, open Settings and then Linked devices, and log out of any computer or browser you don't recognise. Then turn on two-step verification under Settings and Account, so nobody can register your number on another phone without your PIN.
- Change the passwords for your email and banking apps, from a phone or computer you trust. Tell your contacts not to open any invitation forwarded from your number this week.
If the app won't uninstall even after step 4, back up your photos and contacts (not apps) and reset the phone to factory settings. You can also report the sender's number on the government's Sanchar Saathi portal through its Chakshu service, and inside WhatsApp by opening the chat and choosing Report.
How to send your own invitation so guests can trust it
Hosts can make the scam easier to spot. When your real card always arrives the same way, in a form people can see without installing anything, a fake one stands out.
Send the card as a photo first
A photo shows the whole card in the chat before anyone taps it, which is the best proof that it is only a card. Designers usually hand over a PDF, so convert the card page to an image with our PDF to JPG converter. At its default 150 DPI an A5 card comes out at about 874 × 1,240 pixels, which reads clearly on a phone. Choose 220 DPI if the card has small print, such as a list of functions and timings. It runs in your browser, so the card stays on your device.
If you also send a PDF, keep it small and plainly named
Some guests want a PDF to print. Name it plainly, for example Priya-Arjun-wedding-invitation.pdf, with no extra dots or long tails that a phone screen will cut off. Card PDFs full of photos can be many megabytes, which is slow to download on mobile data, and our Compress PDF tool shrinks the photos while keeping the text sharp. If you have the card as separate photos, JPG to PDF puts them into one file in the right order.
Say what you are sending
Add one line to your message, such as "Our card is attached as a photo and a PDF. There is nothing to install." If a "card from you" turns up later as an APK or with a request to install something, they know it is fake and can warn you.
Share the venue as a pin or a map link
Send the venue as a WhatsApp location pin or a Google Maps link. On printed cards, a QR code that opens the same map link saves guests from typing an address, and our QR Code Generator makes one without a watermark. Guests who are wary of codes on paper can use our guide on how to check if a QR code is safe before they scan.
Check photos for location before sending them as documents
People often send pre-wedding photos as documents so WhatsApp doesn't reduce their quality. A document goes as the original file, along with any GPS location the phone saved in it, which can point to your home. Our Image Metadata Remover shows what a photo contains and removes the location, camera and date details in your browser before you share it.
Frequently asked questions about the wedding invitation scam
Can my phone be hacked just by receiving a fake wedding invite?
Receiving or even downloading the APK does not install it. The harm starts when you install the app and give it the permissions it asks for. Keep WhatsApp and Android updated as well, because updates fix the rare bugs that a booby-trapped image or document could try to use.
Is a wedding invitation PDF safe to open?
A genuine PDF opens in a viewer and cannot install an app on its own. Check that the label really says PDF and that a page preview shows. If the PDF contains a link that asks you to install something or log in, don't follow it.
I use an iPhone. Am I safe from this scam?
An iPhone can't install APK files, so the app version of the scam doesn't work on it. The link version does: a message invites you to "view the card" on a page that then asks for a login, an OTP or a UPI payment. A real invitation never needs any of those.
The invite came from a relative's saved number. Is it safe?
Not necessarily. The malware forwards the fake card to the victim's contacts, so it often arrives from someone you know. Call them on a normal phone call and ask what they sent. If they didn't send an APK, their phone may be infected, and the checklist above applies to them too.
I installed the app but didn't allow any permissions. Do I need to worry?
You are much less exposed, because the app needs Accessibility, notification or SMS access to steal anything. Uninstall it now, turn off "Install unknown apps" for WhatsApp, run a Play Protect scan, and watch your bank SMS for the next few days.
Where do I report a wedding invitation scam in India?
Call 1930 or file a complaint at cybercrime.gov.in if money or data was taken. Report the sender's number through Chakshu on the Sanchar Saathi portal, and report the chat inside WhatsApp so the account can be reviewed.
