On this page
We make link invitations ourselves, so we have a stake in this: guests should be able to trust a genuine one. Everything about the scams below comes from police advisories as reported in the press, linked where we cite them.
What the scam looks like
In April 2026 the Rajasthan police cybercrime branch said fraudsters were sending malicious links and APK files in the name of wedding invitations, including a file named marriage.apk (ThePrint, from PTI). Once installed, it let them take control of the phone, steal OTPs and reach bank accounts. A second version is a web link titled as a wedding invitation which, the police said, either asks for mobile and banking details or secretly installs harmful software in the background. Sometimes it arrives from a known contact whose account has been hacked. The police's rule was blunt: if any file ends with ".apk", it is not an invitation card but a virus.
Police in Himachal Pradesh warned of the same trick in November 2025 (The Tribune): once opened, the malware reads photos, contacts and banking details, then sends the same fake invite on to the victim's contacts. Their cybercrime superintendent said genuine wedding cards normally come as JPG images or PDF files, never as APK links.
In Maharashtra, the cyber police warned in December 2024 of fake invitations "with links to download a fake APK file" (Free Press Journal), and in August 2025 a government employee in Hingoli district lost Rs 1.9 lakh after opening what looked like a PDF wedding card from an unknown number. The message said "Shadi mein zarur aye"; the file was an app (Outlook Money).
Five checks before you tap
- Does it sound like the sender?A known number with a personal line, in the way they actually write. Because hacked accounts are used too, an odd message from a familiar name deserves a quick call.
- Is it a link or a file?A real invitation link opens a page. A file ending in .apk is an app, whatever its name or icon says: in Hingoli, the "PDF" was an app.
- Does the address look right?Read the website name before you tap. Police advise avoiding shortened links, and watching for odd domains and spelling mistakes in the address.
- Does it ask you to install, download or allow anything?A genuine invitation never needs an app, a download or a permission. If your phone asks to install something, or to allow installs from unknown sources, stop there.
- Does it ask for an OTP, UPI PIN or card number?No invitation ever needs these. An RSVP asks your name, how many of you are coming and which functions. Nothing more.
What a genuine link invitation does
| A real invitation | The scam police describe | |
|---|---|---|
| Arrives as | A link, or a JPG or PDF card, from someone you know | An .apk file, sometimes named like a PDF, or a link, often from an unknown or hacked number |
| When you tap | A page opens in your browser, or a picture opens in WhatsApp | The phone asks to install an app, or a page asks for your details |
| Asks for | Your name, how many are coming and which functions | Permissions, OTPs, a UPI PIN, bank or card details |
| If in doubt | Call the sender | Delete it, and call 1930 if money is involved |
It opens in your phone's browser within seconds, straight from the WhatsApp chat. You see the names, each function with its date and time, a map button for each venue, perhaps photos and the couple's song, and a reply form asking your name, how many are coming and which functions. It does not ask you to install anything, pay anything or log in.
Ours, as an example: Invifest invitations open at an invifest.in address followed by the couple's names. They never ask a guest for money, an install or an OTP, and every one asks search engines not to list it, so it is found through the link the family sends you, not through a search.
A JPG or PDF card is also genuine, as the police say. It just cannot carry a map button, a reply form or a corrected time, which is why many families now send a link as well. Our printed or digital guide covers when each makes sense.
For hosts: send links your guests will trust
Your guests have read the same warnings. A few habits make your invitation look like what it is:
- Send it from your own number, with your name and a personal line, never a bare link.
- Never use a link shortener. Send the full address, so people can see where it goes.
- Say what it is: "It opens in your browser, nothing to download."
- Call the elders, or send a voice note first, so the link that follows is expected.
- Offer a PDF to anyone wary of links. Invifest makes a PDF of your invite for ₹1,000, page for page.
- Check the preview. A link whose WhatsApp preview shows your cover picture and names looks like an invitation; a blank one looks like anything.
- Use personal links if you can. With Aangan (₹3,000), every guest gets their own link from your own WhatsApp, and it opens with their name on the first screen.
How to send it to a long list is in sending wedding invitations on WhatsApp, and making the link itself in how to make a wedding invitation website.
If you already installed something
Act quickly, and do not be embarrassed: these files are built to look real.
- Cut the connectionTurn on flight mode, or switch off mobile data and Wi-Fi.
- Call your bankAsk them to block your cards and UPI, and watch your account for payments you did not make.
- Remove the appUninstall anything you installed from the invitation, from your phone's settings.
- Change your passwords and PINDo it from a different phone if you can, starting with your bank, UPI apps and email.
- Report itCall 1930, the national helpline for financial cyber fraud, or report it at cybercrime.gov.in.
- Warn your contactsHimachal police say the malware can send the same fake invite on to everyone in your phone.
Invitation designs
6 designs you can personalise, from ₹2,499. Open any one to see it full size, with a live demo.
Questions people ask
Can a wedding invitation link hack my phone?
The scams police describe need something from you: installing an app file (.apk), or typing in bank details, an OTP or a PIN. Police also warn that some links try to install harmful software, so keep your phone updated and never allow an install from an invitation. A link from someone you know that simply opens a page and asks only for an RSVP is not the pattern they describe.
What is the wedding card APK scam?
A message posing as a wedding invitation, with an app file (.apk) or a link to one. Once installed, it lets fraudsters read messages and OTPs and reach bank accounts. Police in Rajasthan, Himachal Pradesh and Maharashtra have warned about it.
How do I know a wedding invitation link is genuine?
It comes from someone you know, in words that sound like them. It opens a web page, not a file, and it asks for nothing beyond your RSVP. If in doubt, call the sender before you tap.
Why do police say real cards come as JPG or PDF?
Their warning is about app files: a real card is never an .apk. An invitation website from someone you know, opening as a page in your browser, is also normal, as long as it never asks you to install anything or to type an OTP or PIN.
Do Invifest invitations ask for anything?
No install, no payment and no OTP. The reply form asks only your name, how many are coming and which functions. Invifest invitations open at an invifest.in address followed by the couple's names.
Where do I report a wedding invitation scam?
Call 1930, the national helpline for financial cyber fraud, or report it at cybercrime.gov.in. Tell your bank at once if money or card details are involved.
