What the scam looks like
The pattern reported by police is simple. A message arrives on WhatsApp, often from an unknown number but sometimes from a friend whose phone is already infected, saying something like "you are invited to my wedding, please see the card". Attached is a file with a name such as marriage.apk or Wedding Invitation.apk. An APK is an Android app installer, not a card. Installing it gives the sender a foothold in the phone: police advisories describe access to messages and OTPs, contacts and photos, and in reported cases, money taken from bank accounts.
The cruel part is how it spreads. Once installed, the malware can send the same fake invitation to everyone in the victim's contacts, so the next person receives it from a name they recognise. That is why a familiar sender is not proof that a file is safe.
Rajasthan Police and the Himachal Pradesh cybercrime cell have both issued public warnings, and the Himachal advisory makes the most useful point for guests: genuine wedding cards are normally shared as JPG images or PDF files, never as APK links.
Five signs an invitation is fake
- The file name ends in .apk, or your phone asks whether to install an app or allow installs from unknown sources.
- The link opens a page that asks you to log in, enter an OTP, give your card or UPI details, or download something to view the card.
- It comes from an unknown number with no name, no personal message and no detail only the real family would know.
- A familiar contact sends it with unusually generic wording, or sends it to a group they would never invite as a whole.
- The link is a shortened or odd-looking address, and the message pushes you to open it urgently.
One sign is enough. If any of these is true, do not open it. Call the person on a number you already have and ask whether they sent it.
If you already tapped or installed it
- Turn on flight mode or switch off mobile data and Wi-Fi straight away, so nothing more is sent from the phone.
- Uninstall any app you do not recognise. On Android, check Settings, then Apps, for anything installed today.
- Call your bank to block cards and UPI if you entered any detail or received an unexpected OTP, and change your important passwords from a different device.
- Report it on the national cybercrime helpline 1930 or at cybercrime.gov.in. Reporting quickly gives the best chance of stopping a transaction.
- Warn your contacts with a short message: my phone may have sent a fake wedding invitation, please do not open it.
If you are the couple: make your link easy to trust
These warnings have made some guests nervous about any wedding link. One person in a wedding forum put it bluntly: they would rather not click invitation links at all because of spam and fraud. That is a reasonable instinct, and your invitation should work with it, not against it.
The fix is mostly about how you send, not what you send. A link that opens in the browser, shows a picture and your names in the WhatsApp preview, and arrives with a personal line from someone the guest knows is very different from an anonymous file. If your link shows no picture, fix that first: see why a wedding link shows no picture on WhatsApp.
- Send from a number the guest has saved, ideally a parent or the couple, not a new number or a vendor's phone.
- Write one personal line before the link: who you are, what the occasion is and that this is your invitation.
- Never send the invitation as an app or a file that needs installing. A web link, an image or a PDF is all a guest should ever receive.
- Use a link that opens straight in the browser, with no login, no app and no permissions.
- Check that the WhatsApp preview shows your photo or design and your names before you send it widely.
- For elders and anyone nervous, call first and tell them the invitation is coming.
Words to send with the link
A short message that names the sender and the occasion, and tells people they will not need to download anything, answers the worry before it starts.
Namaste [Name] ji, this is [Your name], [Bride/Groom]'s father. With great joy we invite your family to [Bride] and [Groom]'s wedding on [date] in [city]. Our invitation opens in your browser, nothing to download: [link]. I will also call you this week.
Hi [Name]! It's [Your name]. We're getting married on [date] and we'd love you there. Here's our invitation, it opens as a normal web page with all the events and the map: [link]
Yes, it's really us! Thank you for checking, there are so many fake ones around. It's a web page, no app or download. You can also call me on this number anytime.
What a safe digital invitation looks like
A trustworthy invitation is a web page on a stable address. It shows your names and design in the preview, opens without asking for anything, and never requests payment details, OTPs or permissions. If it collects replies, it asks only what the hosts need, such as names and which events a guest will attend. See the wedding website privacy checklist for what else to keep out.
Parvaya invitations work this way: a private link that opens in any phone's browser, with no app, no login and no download, and replies that come straight to the couple's own WhatsApp number. If you are still deciding how to send yours, the WhatsApp wedding invitation messages guide has more wording.
Common questions
Frequently asked questions
Can a wedding invitation really be a virus?
A real invitation cannot, but a fake one disguised as an invitation can. Police in Rajasthan and Himachal Pradesh have warned about APK files sent on WhatsApp that install malicious apps when opened.
Is it safe to open a PDF or image wedding card?
Images and PDFs are the normal formats for a wedding card and police advisories describe them as the genuine ones. Still be cautious with unknown senders, and never install anything a card asks you to install.
My relative sent me an APK invitation. What should I do?
Do not open it. Call the relative on their usual number, since their phone may be infected and sending it automatically, and tell them to report it on 1930.
Will guests trust a wedding website link?
Most will, if it comes from a number they know with a personal line and shows a proper preview. Telling them it opens in the browser with nothing to download removes most of the hesitation.
Where do I report a fake wedding invitation scam in India?
Call the national cybercrime helpline 1930 or file a complaint at cybercrime.gov.in. If money has left your account, call your bank immediately as well.