SBI Rewards Scam: Beware of Fake SBI REWARDZ.apk Files Stealing Bank Data

Mumbai. Saturday, 30 May 2026

Urgent public advisory warning its millions of account holders against a sophisticated cyber fraud wave. Scam messages are flooding messaging platforms like WhatsApp, SMS, and Telegram, falsely claiming that users can redeem pending cash rewards or loyalty points from SBI.

However, cybersecurity authorities—including the PIB Fact Check unit have revealed that clicking these links downloads a dangerous file usually named “SBI REWARDZ.apk” or “SBI REWARD POINT.apk”. Once installed, this malicious software grants hackers full access to your smartphone, silently wiping out bank accounts.

Understanding the Fake SBI APK Scam: How it Works

The scam exploits basic social engineering by manipulating an individual’s desire for quick financial rewards combined with a manufactured sense of urgency.

• The Bait: You receive a message stating something like, “Dear Valued Customer, your SBI Bank Reward Points (Rs. 9,980) will expire today. Download the SBI REWARD App now to claim cash directly into your account.”

• The Trap: The text includes a direct link to an Android Application Package (APK) file instead of linking to the secure Google Play Store.

• The Malware Execution: Because it is an external APK file, it prompts the user to bypass standard Android security settings (“Allow installation from unknown sources”).

Once installed, the application does not give any rewards. Instead, it functions as a highly aggressive Trojan horse.

[Scam Link via WhatsApp/SMS] 
       │
       ▼
[User Installs "SBI REWARDZ.apk"] 
       │
       ▼
[Malware Grants Permissions to Itself] 
       │
       ▼
[Steals OTPs, SMS, & Contact Lists] 
       │
       ▼
[Data Sent to Hacker's Firebase Server] 

What Hidden Danger Lurks Inside the App?

According to forensic code analysis by cyber experts, the malicious script activates background processes (BackgroundService and SmsReceiver) instantly upon installation. It subtly gains authorization to read your SMS messages, call logs, contacts, and notifications.

The app operates invisibly. When a hacker attempts to log into your net banking or transfer money using your credentials, the malware intercepts the incoming OTP (One-Time Password) and forwards it to unsecured command servers (like Google Firebase) without ever lighting up your phone screen or notifying you.

Crucial Corrections: Facts vs. Scam Fallacies

To stay ahead of cybercriminals, look closely at the glaring errors built into these phishing attempts:

Emergency Next Steps: What to Do If You’ve Been Infected

If you or someone you know has accidentally clicked a suspicious link and installed an external application, do not panic. Act immediately using the following sequence:

Best Practices for Complete Mobile Security

• Download Safely: Only install mobile banking tools via the official Google Play Store or Apple App Store. Verify that the developer name explicitly states State Bank of India.

• Lock Unknown Sources: Keep the “Install Unknown Apps” permission globally disabled in your Android system configuration.

• Verify Directly: If an SMS claims you have thousands of rupees waiting, close the message and open your official SBI YONO application or visit the secure web portal to inspect your genuine account dashboard status.

For more verified digital safety warnings, public interest alerts, and trusted regional updates, keep browsing official media sections on Matribhumi Samachar English.