Android’s New Feature Blocks Sideloading During Calls: Legal Implications and Remedies for Cyber Fraud Victims in India

The digital landscape in India has witnessed an alarming surge in sophisticated cyber fraud schemes. Among the most pervasive methods employed by cyber syndicates is social engineering executed over live phone calls—often coercing victims into downloading malicious Android Application Packages (APKs) to drain bank accounts.

In response to this growing menace, Google introduced an updated security feature for Android that blocks users from sideloading (installing applications from sources outside the Google Play Store) while engaged in an active phone call. While this technical safeguard represents a significant victory for mobile security, understanding the mechanics of these frauds and knowing your legal rights under Indian law remains critical.

At APS Law, we regularly assist individuals and businesses facing the aftermath of cybercrime across Mumbai, Thane, and the Mira-Bhayandar region. Here is a detailed breakdown of how this fraud operates, the relevant Indian legal framework, and the steps victims should take immediately.

---

The Threat Architecture: How Call-Based Sideloading Scams Work

Modern cybercriminals rarely rely on direct hacking alone; they exploit psychological manipulation combined with malicious software. In a typical call-based fraud scenario, the sequence unfolds as follows:

1. The Pretext (Social Engineering): Scammers impersonate courier services (FedEx/customs clearance), telecom operators (impending SIM deactivation), power distribution companies (unpaid electricity bills), or law enforcement agencies (orchestrating the infamous "Digital Arrest" scam).
2. The Directive: The caller insists that to resolve the emergency, the victim must download an "official support" or "verification" application. Rather than directing them to official app stores, the caller shares an APK link via WhatsApp, Telegram, or SMS.
3. Active Call Entrapment: By keeping the victim engaged on the line, the fraudster creates cognitive overload, preventing the victim from verifying credentials or consulting family members.
4. Device Compromise: Once sideloaded, these malicious apps request dangerous permissions—such as reading SMS messages (to capture One-Time Passwords/OTPs) and Accessibility Services (allowing remote control or screen scraping). Within minutes, unauthorized transactions drain the victim's accounts.

The Technical Countermeasure

Android’s security mechanism intervenes directly at Step 4. When an active voice or video call is detected, the operating system disables the installation of untrusted APKs originating from web browsers, messaging apps, or file managers. By restricting sideloading in real time, the device acts as a circuit breaker, neutralizing the psychological urgency imposed by the caller.

---

The Legal Framework: IT Act, 2000 and the New Criminal Laws

When a cyber fraudster induces an individual into sideloading malware and misappropriates funds, multiple provisions under Indian law are triggered.

1. Information Technology Act, 2000 (IT Act)

• Section 43 read with Section 66: Imposes civil liability and criminal punishment for unauthorized access, downloading data, or introducing computer contaminants (malware/trojans) into a computer system or smartphone.
• Section 66C (Identity Theft): Penalizes the fraudulent or dishonest use of electronic signatures, passwords, or unique identification features (such as net banking credentials or OTPs).
• Section 66D (Cheating by Personation): Punishes individuals who cheat by personating someone else using any computer resource or communication device—carrying imprisonment of up to three years and fines.

2. Bharatiya Nyaya Sanhita, 2023 (BNS)

Following the replacement of the Indian Penal Code (IPC), financial cyber offences are prosecuted under the BNS:

• Section 318(4) (Cheating): Replaces Section 420 of the IPC, prescribing severe penalties for dishonestly inducing delivery of property or funds.
• Section 308 (Extortion): Frequently applicable in "Digital Arrest" scenarios where victims are coerced under threat of fabricated criminal prosecution.
• Section 61 (Criminal Conspiracy): Enforced against organized cyber syndicates operating across inter-state boundaries.

3. Evidentiary Standards Under the Bharatiya Sakshya Adhiniyam, 2023 (BSA)

To successfully prosecute cyber offences or secure recovery, digital evidence must be handled meticulously. Section 63 of the BSA (replacing Section 65B of the Indian Evidence Act, 1872) governs the admissibility of electronic records. Call logs, WhatsApp chat histories, APK download links, SMS alerts, and bank transaction statements must be retrieved and preserved in strict compliance with the statutory certificate requirements to withstand judicial scrutiny.

---

Action Plan for Victims in Mumbai, Thane, and Mira Road

If you or someone you know falls prey to an APK sideloading or digital arrest scam, swift action within the "Golden Hour" (the initial 1–2 hours following unauthorized transactions) is critical to freezing the transfer of funds.

1. Trigger the National Cybercrime Reporting Portal Immediately

• Dial 1930, the National Cyber Helpline managed by the Indian Cyber Crime Coordination Centre (I4C).
• Provide your transaction reference numbers, bank account details, and the beneficiary account details (if visible in transaction alerts). This initiates the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS) to freeze funds along the intermediary banking rails.
• Lodge a formal electronic report at cybercrime.gov.in.

2. File a Zero FIR Under Section 173 of the BNSS

Under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), a police station is legally bound to register a Zero FIR irrespective of territorial jurisdiction if a cognizable offence is disclosed. You may approach:

• Mumbai: The BKC Cyber Crime Police Station or your local divisional police station.
• Thane: The Thane Cyber Police Station (located near Commissionerate, CIDCO).
• Mira-Bhayandar: The MBVV (Mira-Bhayandar Vasai-Virar) Cyber Cell.

Ensure that you submit an indexed paper trail: bank account statements, device call records, screenshots of the conversation, and the specific APK download link.

3. Invoke Banking Ombudsman Guidelines

Under the Reserve Bank of India’s (RBI) Master Direction on Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, a customer has zero liability if the fraud occurs due to a contributory fraud/negligence/deficiency on the part of the bank.

Where the fraud occurred due to third-party breach or social engineering, notifying your bank within three working days substantially limits your liability. If the bank fails to resolve your grievance within 30 days, an application should be moved before the RBI Integrated Ombudsman.

---

Frequently Asked Questions (FAQs)

1. Does Android's new update guarantee complete protection against financial scams?

No. While blocking sideloading during an active phone call stops one major vector (screen-share/malicious APK installation), it does not protect against scenarios where the user hangs up before installing, authorizes transactions voluntarily via legitimate UPI apps, or falls for phishing websites that harvest card details.

2. Can the police refuse to register my FIR because the fraudster is in another state?

No. Under Section 173 of the BNSS, police cannot decline an FIR based on jurisdictional boundaries. If the jurisdictional cyber cell is not immediately accessible, any local police station must record a Zero FIR and transfer the case to the appropriate investigative unit.

3. What should I do with my phone after installing a suspicious APK?

Immediately switch the device to Airplane Mode or turn off Wi-Fi and mobile data to break communication with the command-and-control server. Do not perform a factory reset before consulting a legal professional or cyber forensic expert, as doing so may destroy crucial electronic evidence needed under Section 63 of the BSA.

4. How can a legal professional assist in cyber fraud recovery?

A legal practitioner assists in interfacing with law enforcement agencies, drafting statutory notices under the IT Act and BNSS, moving applications before the jurisdictional Magistrate for de-freezing victim accounts or releasing frozen funds (under Sections 497/503 of the BNSS), and pursuing claims before the RBI Banking Ombudsman.

---

Legal Assistance Across the Mumbai Metropolitan Region

Cyber fraud requires an aggressive, organized, and time-sensitive response combining statutory procedural knowledge with practical litigation strategy.

If you have suffered a financial cyber loss or require counsel on navigating cyber compliance and reporting across Mumbai, Thane, or Mira Road, contact APS Law to schedule a focused legal consultation.