Fake Hospital Appointment Scam in India: One Google Search Can Put Your Money at Risk

Imagine this. It's 8:30 in the morning. Someone in your family needs to see a doctor. You open Google and type "ABC Hospital appointment number." You see a phone number. It looks legitimate. You call.

The person answers confidently: "Yes sir, hospital appointment desk. How can I help you?" You explain that you need an appointment. The person asks for a few details. Then comes the innocent-looking request: "I'll send you our appointment booking application on WhatsApp. Please install it and complete the booking."

You receive `Hospital Appointment.apk`. You install it. Maybe you're asked to pay ₹5 or ₹10 to confirm the appointment. You think "it's just a small payment." And then your phone may no longer be entirely yours.

This is the fake hospital appointment APK scam. On 20 September 2026, Kerala Police issued a warning about precisely this type of fraud.

What Is the Fake Hospital Appointment Scam?

Fraudsters are targeting people searching online for hospital phone numbers, doctor appointments, OPD timings, emergency contact numbers, hospital departments, and diagnostic services.

The scammer's first objective isn't necessarily to steal money — it's to become the person you trust. They may pretend to be hospital reception staff, appointment executives, customer-care representatives, or hospital booking agents. Once you've accepted their identity, they can introduce the next step: "Download this app." That's where the danger escalates.

The Scam Has a Clever Beginning

Most people know "don't download suspicious apps." But the scammer isn't sending you an app randomly — they're giving you a reason to download it, and that reason sounds perfectly normal: "You need this app to book your appointment." That's what makes the scam dangerous.

How the Scam Works

Step 1: You Search Google

You search for something like "XYZ Hospital contact number" or "XYZ Hospital appointment." You expect Google to show you the hospital, but scammers may exploit search results, fake listings or misleading contact information.

Kerala Police specifically warned people not to blindly trust hospital numbers found through Google searches and advised verifying contact details through the hospital's official website or verified social-media accounts.

Step 2: You Call the Fake Number

Someone answers. They sound professional. They know the hospital's name. They may ask the patient name, doctor name, preferred date, mobile number, age, and department. Suddenly the conversation feels legitimate — but the person may have nothing to do with the hospital.

Step 3: They Move You to WhatsApp

This is a crucial step. The person may say "I'll send you the appointment link," or "I'll send the hospital booking application." Then WhatsApp receives a file: `Hospital Appointment.apk`. The name itself sounds harmless. That's the trick.

🚨 Stop: APK Is Not a Normal Document

An APK is an Android application package — an app installer. If someone sends you an APK through WhatsApp and tells you to install it to book your hospital appointment, don't. Not even if they know the hospital name, sound like hospital staff, know your appointment details, have a professional WhatsApp profile, ask for only ₹5, or say the app is required.

Step 4: The "Small Payment" Trap

Some scams may ask you to make a tiny payment — ₹5, ₹10, ₹20. The amount is deliberately small because you're less likely to become suspicious. You may think "it's only ₹5." But the ₹5 may not be the real objective — the real objective could be your card information, banking information, device access, SMS access, notifications, OTPs, or UPI-related information. The ₹5 isn't the scam — it may simply be the door.

Step 5: The APK Gets Dangerous Permissions

A malicious app may request access to SMS, notifications, contacts, phone, accessibility-related functions, and other sensitive device permissions.

Kerala Police warned that malicious hospital appointment APKs could expose sensitive information, OTPs and UPI services and potentially facilitate unauthorised financial transactions.

Step 6: The Victim Doesn't Realise the Phone Has Been Compromised

This is one of the scariest parts. You might still see your normal home screen, your normal WhatsApp, your normal banking apps, your normal UPI apps. Nothing necessarily looks broken. Meanwhile, malicious software may be attempting to access sensitive information or facilitate transactions. You think you're booking a doctor — the attacker may be trying to access your finances.

A Reported Case: Significant Losses While Trying to Book an Appointment

This isn't merely a theoretical scenario. In a case reported from Lucknow in September 2026, a woman trying to book a hospital appointment for a relative was reportedly asked to download an application called `hospital service.apk`. According to the reported complaint, she was then asked to make a small ₹5 payment, and later discovered two unauthorised credit-card transactions of ₹1,26,900 each — a total reported loss of ₹2,53,800. Police reportedly registered an FIR and the investigation was underway.

This detail is based on media reporting of the individual complaint and has not been independently verified by AsliReview. The broader Kerala Police warning and pattern, however, is a current, confirmed advisory.

That's the terrifying part regardless — the conversation started with a hospital appointment, and the reported financial loss was more than ₹2.5 lakh.

Why This Scam Works So Well

Because scammers aren't selling you a fake investment. They aren't promising ₹10 lakh. They aren't telling you that you've won something. They're offering something you genuinely need: healthcare. And when a family member needs medical attention, people naturally want to solve the problem quickly. That urgency becomes the attacker's advantage.

The Psychology Behind the Scam

The fraud chain looks like this: medical need → Google search → fake contact number → helpful-sounding caller → WhatsApp → hospital appointment APK → small payment → device/data access → financial fraud.

Notice something important: the victim doesn't make one huge mistake. They make several tiny decisions that each seem reasonable. That's what makes social engineering so effective.

🚩 Warning Signs

Be extremely careful if someone claiming to represent a hospital:

• Contacts you after you searched for the hospital
• Sends you an APK through WhatsApp
• Tells you to install an app outside Google Play
• Asks you to pay through an unknown link
• Asks for card details or an OTP
• Requests SMS or notification access
• Requests unusual permissions
• Tells you to keep your phone on a call
• Gives you another phone number for "verification"
• Pressures you to complete the appointment immediately
• Says the app is mandatory

One red flag can be enough to stop.

🚨 The Biggest Red Flag: "I'll Send You the Hospital App on WhatsApp"

Stop. A hospital may have an official mobile application, but that does not mean an unknown caller can safely send you an APK file. Don't install apps because a stranger tells you to.

The Google Search Trap

When you search "Hospital X phone number," you assume the first useful-looking number belongs to the hospital. That's not a safe assumption — a search result can contain incorrect information, outdated information, third-party listings, misleading listings, or fraudulent contact details.

Kerala Police specifically advised users to verify hospital numbers through the organisation's official website or verified social-media presence rather than blindly trusting numbers found through Google search.

AsliReview's New Rule

Google can help you find a hospital. It doesn't automatically authenticate the phone number. Before calling, find the hospital's official website, then compare the number. If possible, call the number published on the hospital's official website.

What Should a Genuine Appointment Process Look Like?

It depends on the hospital. Some allow website booking, official mobile apps, phone appointments, hospital portals, walk-in registration, or verified third-party booking platforms. But the important part: you should be able to verify the process independently. If a stranger says "this is the only way," don't trust them automatically.

🚫 Never Install an APK Sent Through WhatsApp

This deserves its own rule. `appointment.apk`, `KYC.apk`, `refund.apk`, `hospital.apk`, `courier.apk`, `delivery.apk`, `bank.apk` — the name doesn't matter. If an unknown person sends you an APK and asks you to install it, don't.

Police advisories have repeatedly warned against installing APKs received through unknown links, WhatsApp or email, and hospital appointment APK fraud has been listed among several APK-based fraud patterns highlighted by police in multiple states.

What If the App Is Already Installed?

Don't panic, but act immediately.

Step 1: Disconnect

If you suspect the phone has been compromised, disconnect it from the internet while you assess the situation.

Step 2: Don't Use It for Banking

Avoid using the affected device for financial transactions until you've secured it.

Step 3: Contact Your Bank

Tell the bank that a suspicious application may have compromised the device.

Step 4: Secure UPI

Check your UPI apps and recent transactions.

Step 5: Check Permissions

Review recently installed applications and suspicious permissions.

Step 6: Change Important Passwords

Use a trusted device if compromise is suspected.

Step 7: Report Financial Fraud Immediately

Call 1930 or report through the National Cyber Crime Reporting Portal. Kerala Police specifically advised victims to use 1930 or cybercrime.gov.in.

🚨 Don't Ignore Small Transactions

This is another important warning from the latest Kerala Police advisory. Some fraudulent activity may involve repeated small-value transactions. Police specifically cautioned that users should not ignore repeated suspicious transactions simply because the amounts are small — the warning highlighted the potential relevance of UPI Lite and small transactions that may not always require a separate OTP.

So if you suddenly see ₹199, ₹499, ₹799, ₹999 repeatedly leaving your account, don't say "it's only a few hundred rupees" — investigate immediately. Small transactions can add up quickly.

The ₹5 Payment Trick

Let's say someone tells you "sir, appointment confirmation requires ₹5." Your brain says "₹5? That's nothing." Exactly — the amount feels too small to trigger suspicion. But ask yourself: why am I being asked to install an unknown application for a ₹5 payment? That question is far more useful than "is ₹5 safe?"

📌 Reality Check

Myth: But the person knew my hospital appointment details.

Reality: That doesn't prove they're from the hospital. Information can come from public sources, search behaviour, data leaks, previous interactions, or information shared during the call. Knowing some information about you doesn't authenticate the person.

📌 Reality Check

Myth: But the WhatsApp account looked professional.

Reality: A professional profile doesn't prove the person works for the hospital. The same principle applies to bank representatives, courier companies, insurance companies, government departments, and shopping platforms.

📌 Reality Check

Myth: But the app opened normally.

Reality: That's not proof that it's safe. Malware doesn't necessarily announce "your phone has been compromised" — it may quietly run in the background.

The AsliReview 5-Second Hospital Test

Before booking an appointment through someone who contacted you:

• Did I find the number through Google? Verify it independently.
• Did they send me an APK? Don't install it.
• Are they asking for payment through an unfamiliar link? Stop.
• Are they asking for OTP/card/UPI information? Stop immediately.
• Can I book directly through the hospital's official website? Do that instead.

How to Book Safely

Search → verify (open the hospital's official website) → contact (use the number published there) → book (use the hospital's verified booking process) → pay (only through an authorised payment channel).

What Families Should Teach Parents

This scam could particularly affect people who aren't comfortable with technology. Tell your parents or grandparents: if you need a hospital appointment, don't call a random Google number and don't install an APK someone sends on WhatsApp. Instead, call the hospital number saved from its official website — and if something feels unusual, ask another family member to verify it. There's absolutely no shame in double-checking.

What Hospitals Can Do

This problem isn't only about patients. Hospitals can reduce the risk by clearly publishing official contact numbers, maintaining verified online listings, warning patients about fake numbers, publishing official booking links, advising patients never to install APKs sent through WhatsApp, monitoring fake listings where possible, and providing clear appointment procedures. The easier it is for patients to identify the genuine channel, the harder it becomes for scammers to impersonate it.

The AsliReview "No APK" Rule

Hospital + WhatsApp + APK = STOP. Not every hospital-related WhatsApp message is fraudulent, but an unexpected APK sent by an unknown person should be treated as a major warning sign.

Common Mistakes

• Trusting the first Google phone number — verify it through the hospital's official website
• Installing "Hospital Appointment.apk" — don't install APKs sent by strangers
• Making a ₹5 payment without thinking — small payments can be part of a larger fraud attempt
• Sharing OTP — never share an OTP with an unsolicited caller
• Giving card details to an appointment caller — use an authorised payment channel
• Ignoring small unauthorised transactions — repeated small transactions can signal compromise
• Waiting until tomorrow — if money has moved, report immediately

The AsliReview 10-Second Rule

If someone contacts you about a hospital appointment, stop. Take 10 seconds. Ask "can I independently verify this person and this number?" Then open the hospital's official website yourself. If the number doesn't match, hang up. If they send an APK, delete it. If money has already moved, call 1930 immediately.

What Makes This Scam Different?

We've seen fake bank calls, fake courier messages, fake e-challans, fake refunds, fake customer care. Now the scammers are exploiting something even more personal: healthcare. That's important because people don't approach healthcare interactions with the same suspicion they may have toward investment offers. When someone needs a doctor, they want help — scammers know that.

The Bigger Lesson

The internet has made finding healthcare information incredibly convenient — hospitals, doctors, phone numbers, reviews, appointment timings, directions, all in seconds. But convenience creates another problem: how do you know the person on the other side is genuine? The safest habit isn't "never trust Google" — it's "verify important information through the organisation's own official channel."

💡 AsliReview Tip

Don't let Google choose whom you trust. Use Google to find the hospital, then go one step further — find the hospital's official website, verify the number, and book through the authorised channel. If someone suddenly says "I'll send you the appointment APK on WhatsApp," your answer should be "no thanks."

🚨 Already Installed a Suspicious APK?

Don't wait for money to disappear. Act now: disconnect the suspicious device from the internet where appropriate, contact your bank/payment provider, check UPI and card transactions, review installed apps and permissions, secure important accounts from a clean device, call 1930 if financial fraud has occurred, and report through cybercrime.gov.in. The faster you react, the better.

Final Takeaway

The next time someone needs a hospital appointment, the process should be simple: find the hospital, verify the contact number, book through the official channel, pay through the authorised system, and never install an APK sent by a stranger.

Because the next scam may not begin with "you've won ₹10 lakh!" It may begin with something much more believable: "Hello sir, I am calling from the hospital. I can help you book your appointment." And that's exactly why you should pause.

When your health is urgent, don't let the scammer make your decisions for you. Stop. Verify. Then proceed.