Fake Gas Bill APK Scam: A ₹12 Charge, ₹1.65 Lakh Lost Key takeaways
- Gurugram Police say a resident lost ₹1,64,900 after a WhatsApp message warning of a pending "HCG" gas bill led to a file called "HCG BILL UPDATE.apk," which opened a fake Razorpay-style payment screen asking for a ₹12 token payment, as reported by The Tribune, UNI India, Daily Pioneer and The420.in.
- While entering card details to pay that ₹12, the victim noticed a string of unauthorised transactions had already drained the account — a classic fake gas bill APK scam pattern where a tiny "verification" charge is the moment real card data is captured.
- Gurugram's cybercrime unit traced the SIM cards used in the fraud to two men from Bihar's Banka district, arrested on 16 October 2026, who had fraudulently obtained SIMs in other people's names and resold them up a chain to fraud operators.
- Never open an APK file sent over WhatsApp or SMS, even one named after a utility bill, and treat any "pay a small amount to verify" request as a red flag.
- Arjuna cannot stop a phone call, but WhatsApp Scam Detection, Fake APK Detection / Sideloaded App Detection (Premium) and Fake Payment Page Detection are built to check the message, the file and the payment screen at each of those three steps — none of them is a guarantee. Arjuna: Fraud & Scam Guard is an Android and iOS app that scans links and websites for phishing and malware in real time — download it here. What happened in the Gurugram gas bill APK scam According to Gurugram Police, the complainant received a WhatsApp message on 9 October 2026 from an unknown number, warning that an "HCG" gas connection bill was overdue and that the connection would be cut off unless it was paid immediately. The message included a phone number. When the complainant called it, the person on the other end sent a file over WhatsApp named "HCG BILL UPDATE.apk." Opening the file launched a payment screen made to resemble the Razorpay payment gateway, asking for a token payment of just ₹12 — small enough to seem routine. While entering card details to make that payment, the complainant noticed a string of unauthorised transactions already going through, totalling ₹1,64,900. The case was reported independently by The Tribune, UNI India, Daily Pioneer, The420.in, and, in Hindi, ETV Bharat and News Mobile, with all six outlets agreeing on the complaint date, the APK filename, the fake payment screen, and the total loss. Why the arrest matters as much as the scam What makes this case more than a single cautionary tale is what came after it. Gurugram Police's cybercrime unit traced the SIM cards used to run the fraud to two men from Bihar's Banka district — Nirmal Kumar, who also went by Vijay Kumar, and Gopi Kumar Yadav — arrested on 16 October 2026. According to police, Nirmal had fraudulently obtained SIM cards registered in other people's names and sold them to Gopi for ₹1,000 each; Gopi then resold them to the fraud operators for ₹1,500 each. Both men were produced in a Gurugram court, and police recovered two phones and the SIM cards involved. This matters because it shows the scam isn't a single lone actor sending one fake message — it's a small supply chain. Someone sources SIM cards under false names, someone resells them, and someone else runs the actual fraud campaign using whichever number is current and disposable. That's also why reporting a scam number, even after the money is gone, has value beyond your own case: it feeds the investigation that eventually traces the chain back to the people selling the SIMs. The pattern behind the "small payment" trick The ₹12 token payment is the part of this scam worth remembering, because it's a pattern that shows up across many fake-bill and fake-KYC scams, not just this one. A tiny amount feels low-risk, almost like a formality — exactly the point. The moment you type a card number, expiry date and CVV into that screen to pay ₹12, the fraudsters have everything they need to attempt other charges, regardless of whether the ₹12 itself ever completes. A fee this small is designed to lower your guard, not to test anything official. Genuine utility providers do not ask you to "pay ₹1" or "pay ₹12 to verify your account" through a link or file sent over WhatsApp. Any bill payment should happen inside the utility's own official app or website, not a payment screen that arrived as an attachment. Practical steps to avoid this scam
- Never open an APK file sent over WhatsApp, SMS or email, no matter what it's named — a real bill, government notice or KYC update never arrives as an installable app file.
- Don't call back unknown numbers cited in an urgent bill or disconnection message. Look up your utility provider's number from your last real bill or their official website instead.
- Treat any "small payment to verify" request as a warning sign, whether it's ₹1, ₹12 or any other token amount — it's rarely about the money, it's about collecting your card details.
- Pay utility bills only inside the provider's official app, website, or an established, well-known payment app — never through a link or file someone sent you directly.
- Check your bank and card statements regularly, especially after any unfamiliar payment attempt, so unauthorised transactions are caught early.
- Report the number and the file to family members, especially older relatives who manage household bills and may be targeted with the same message. If you've already lost money
- Call your bank or card issuer immediately using the number on the back of your card, and ask them to block the card and dispute the unauthorised transactions.
- Report the fraud to the national cybercrime helpline 1930 or at cybercrime.gov.in as soon as possible — faster reporting improves the odds of freezing funds before they move further.
- Keep the WhatsApp message, the APK file name, and screenshots of the payment screen and your bank statement as evidence.
- File a police complaint, as the Gurugram victim did — it's this kind of complaint that led investigators to the SIM supply chain in this case. Where Arjuna fits — and where it doesn't This particular scam ran through three steps, and three of Arjuna's confirmed features line up with them. WhatsApp Scam Detection scans WhatsApp messages for malicious links and fake or APK file attachments before you open them — exactly the "HCG BILL UPDATE.apk" step. Fake APK Detection and Sideloaded App Detection (Premium, Device Protection) are built to flag an app installed from outside the Play Store, which is what happens the moment that file is opened. And Fake Payment Page Detection is built for pages designed to look like a real payment gateway — such as the Razorpay-style screen in this case — while actually harvesting card details. What's outside Arjuna's reach is the phone call itself: no confirmed feature verifies who is speaking on the other end of a call, so the moment the victim rang the number in the message is a step no link-or-file scanner can catch. None of the features above are a guarantee — they reduce risk at specific points in the chain, they don't eliminate it. Fake gas bill APK scam: frequently asked questions What is the fake gas bill APK scam reported in Gurugram? A WhatsApp message warned of a pending gas bill and threatened disconnection, with a phone number to call. Calling it led to a file, "HCG BILL UPDATE.apk," which opened a fake Razorpay-style payment screen asking for ₹12 — and unauthorised transactions totalling ₹1,64,900 went through while the victim tried to pay it. Why did the scammers ask for only ₹12? A very small token amount feels routine and lowers suspicion. Entering card details to pay it is enough for fraudsters to capture the information needed to attempt further, larger unauthorised transactions. How were the people behind this scam caught? Gurugram Police's cybercrime unit traced the SIM cards used in the fraud to two men from Bihar's Banka district, who had obtained SIM cards in other people's names and resold them up a chain to the fraud operators. Both were arrested on 16 October 2026. Should I ever open an APK file sent over WhatsApp? No. Legitimate bills, government notices and KYC updates are never sent as an installable app file. Treat any such file as a scam, regardless of who it claims to be from. Can Arjuna detect a scam like this? Arjuna's WhatsApp Scam Detection, Fake APK Detection, Sideloaded App Detection and Fake Payment Page Detection are built to flag the malicious message, the APK install and the fake payment screen at those three steps. It cannot verify who is calling on a phone call, and none of its checks is a guarantee.
Sources
[
- The Tribune: 2 held in Gurugram for supplying SIM cards to cyber fraudsters](https://www.tribuneindia.com/news/delhi/2-held-in-gurugram-for-supplying-sim-cards-to-cyber-fraudsters/amp) [
- UNI India: Crime — Haryana cyber fraud](https://www.uniindia.com/north-india/crime-haryana-cyber-fraud-20dr35/220047) [
- Daily Pioneer: Two produced in Gurugram court for abetting cyber fraud](https://dailypioneer.com/law-justice/two-produced-in-gurugram-court-for-abetting-cyber-fraud) [
- The420.in: Gurugram SIM card cyber fraud](https://the420.in/gurugram-sim-card-cyber-fraud/) Where to report and get help If you lose money or suspect fraud, call the national cybercrime helpline 1930 or report at cybercrime.gov.in. Tell your bank or card issuer straight away. Download and Try Arjuna: Fraud & Scam Guard Arjuna: Fraud & Scam Guard is an Android and iOS app that scans links and websites for phishing and malware in real time, with a free Basic plan. It also includes WhatsApp and SMS scam detection that checks message text for malicious links, and Premium features such as QR Code Scam Detection; some features are Android-only. Download Arjuna: Fraud & Scam Guard · Get it on Google Play · Get it on the App Store Stop. Check. Stay Safe. Related on Arjuna: Scam protection · Phishing links · Android protection · More cyber alerts