If you've spent any time on Indian gaming Telegram channels this week, you've probably seen messages claiming you can install BGMI Air right now. The pitch looks tempting. It really does, especially if you play on a budget phone with 3GB of RAM and hate how heavy the standard Battlegrounds Mobile India client has become. But don't click those links. Circulating files tied to the fake BGMI Air pre-registration APK are malware packages designed to infiltrate your phone and steal your money.
I track mobile scams closely, and in my experience, this one spread faster than usual. Much faster. When Krafton India confirmed that pre-registrations for BGMI Lite, rebranded across several gaming circles as BGMI Air, opened on August 25, 2026, scammers jumped on it immediately. They know millions of Indian college students and young gamers have waited years for an official lightweight battle royale. And scammers know exactly how to exploit that impatience.
What is the fake BGMI Air pre-registration APK scam?
Basically, the scam is dead simple. Fraudsters set up sketchy landing pages and fake Telegram channels promising an early beta build or an exclusive pre-registration installer for BGMI Air. Sometimes they drop links in YouTube Shorts descriptions too. But when you tap that download link, you don't get a game at all. Instead, you get a modified APK that hides a nasty banking trojan.
Krafton India announced that the official lightweight game will launch toward the end of 2026. That's months away. Official sign-ups happen exclusively on the Google Play Store. When you pre-register for a real game on Android, Google never gives you a standalone APK file. Never. You just tap a button in the store, and Google alerts you on launch day (which makes total sense, actually). So if you ask me, any site claiming you need a manual APK download is flat out lying.
The Indian Computer Emergency Response Team (CERT-In) has warned that malicious Android APKs distributed through unofficial chat groups disguise financial trojans capable of intercepting two-factor authentication tokens.
While the exact infection numbers across India are a bit fuzzy, what happens after installation is clear. These dummy apps don't load any battle royale maps. Nothing works. Instead, they just show a fake loading bar or an error saying servers are busy. Meanwhile, behind that static graphic, the code gets to work taking over your device.
How the fake BGMI Air APK download scam targets Indian gamers
Thing is, scammers know budget smartphone users often look for sideloaded files to get around hardware limits. I'm not sure exactly why so many people trust random APKs over official channels, but the lure of early access is powerful. It's brutal. Here is how the trap works from the second you tap a shared link to the moment cash vanishes from your bank account.
- Scammers distribute flashy posters on WhatsApp groups and Discord servers, promising instant early access to Erangel on low-end hardware.
- The link redirects to an unverified third-party file host or a cloned landing page with stolen Krafton logos and fake user reviews.
- The browser prompts you to enable installation from unknown sources, bypassing standard Android security warnings.
- Upon launching, the app demands high-level permissions including SMS access, notification reading, and Accessibility Service access.
- The malware establishes a background connection to an external command server operated by the attackers.
- When your bank sends an OTP for a debit card or UPI transaction, the malware reads the message, forwards it to the scammer, and hides the notification from your screen.
- The scammers initiate unauthorized transfers through linked payment handles, draining balances in increments of ₹5,000 to ₹50,000.
In my experience, modern Android banking malware doesn't even need you to open PhonePe or Google Pay to clean out your account. It works silently. By abusing the Accessibility Service, the trojan can click buttons on your screen and grant itself fresh permissions while your phone sits right on your desk. You won't see a thing.
We saw the exact same tactics during the fake BGMI update APK scam earlier this year. Back then, fake free UC download links infected thousands of phones across Delhi and Uttar Pradesh. The scammers don't write new code from scratch every week. They just reuse the exact same malicious setup whenever a big game update hits the news.
Warning signs of a fake BGMI pre-registration link
Scammers rely on you rushing. They count on it. But if you know what red flags to look for, you can spot these fake links in about five seconds flat.
- The link arrives via direct messages on Telegram, Instagram, or WhatsApp instead of official Krafton social handles.
- The download file is tiny, often between 15MB and 45MB, which is impossible for a fully featured 3D battle royale title.
- The installation prompt demands permission to read your text messages or observe your screen actions before opening.
- The web page uses suspicious domain names ending in random extensions rather than the official battlegroundsmobileindia.com domain.
- The post promises ridiculous incentives like 10,000 free Unknown Cash or exclusive glacier gun skins just for installing the file.
Honestly, if an app asks for Accessibility Service permissions during setup (which no shooter ever needs), I think that's an immediate reason to delete it. Don't think twice. Real multiplayer games never need to control your screen or watch your taps. It's a massive red flag.
You can read more about how these gangs package their attacks in our Scam Alerts and Safety section, where we track active digital frauds across India.
Steps to clean your device and secure your UPI apps
If you downloaded one of these rogue files, if you ask me, you've got to act right now. Don't wait around to see if weird debits show up on your bank passbook tomorrow morning. By then, it's too late.
First, switch on Airplane Mode right away. Cut off Wi-Fi and mobile data completely. This stops the trojan from sending out your tokens or taking commands from the attacker's server.
Second, restart your phone in Safe Mode. On most devices from Samsung, Xiaomi, Realme, or OnePlus, you do this by holding the power button and then long-pressing the Power Off icon until the Safe Mode prompt shows up. Safe Mode stops any third-party app from launching in the background.
Third, jump into your phone settings and open the app manager. Look for unfamiliar apps installed today. Often the scam app hides behind a blank icon or pretends to be a system tool like Google Play Services or System Update (annoying, I know). Find it and hit uninstall.
Fourth, revoke admin privileges. Head to Settings, search for Device Admin Apps, and check that no sketchy tool has permission to lock or control your phone. If you recently installed a malicious WhatsApp beta installer or another sketchy gaming client, remove their device management permissions right now.
Fifth, log into your bank accounts from a clean device, like a laptop or a family member's phone. Change your net banking passwords and temporarily freeze your debit cards. In my experience, moving fast here is the difference between keeping your money and filing police reports for weeks. Then go through your transaction history carefully for any tiny test debits you didn't authorize.
If you want a full walkthrough on checking your phone permissions, our how-to tech guides have complete checklists for Android users.
Where to report online fraud in India
In my experience, the first two hours after an unauthorized transaction give you the only realistic shot at getting stolen money back. Police call this the golden hour. Wait any longer, and the cash is usually gone through an ATM.
Call the national cybercrime helpline at 1930 straight away. Don't delay. The operator takes down your name, mobile number, bank account details, and transaction reference numbers. From there, the 1930 system links up with the Indian Cyber Crime Coordination Centre reporting platform, so partner banks can freeze the scammer's recipient account before they cash out.
After calling, file a formal complaint online at cybercrime.gov.in. Upload screenshots of the download link, the Telegram channel where you found it, your bank SMS alerts, and the transaction IDs. Be sure to save your complaint acknowledgement number, because local police will ask for it.
Make sure you also notify your home bank branch manager in writing within 72 hours. It matters. Under Reserve Bank of India guidelines, reporting unauthorized electronic transactions quickly limits your liability.
Legitimate ways to register for upcoming mobile games
Patience saves money. Krafton India has made the whole process easy, whether you're using an old ₹8,000 phone or a flagship device. The official path is painless.
- Open the Google Play Store on your device and search directly for the official publisher page of Krafton India.
- Locate the verified game listing carrying the official Krafton developer badge.
- Tap the green Pre-register button and turn on the toggle for automatic installation when the game launches.
- Ignore all third-party APK mirrors, media sharing links, and repackaged ZIP archives claiming to offer early test servers.
Look, I get it. Waiting months for a game you want to play is painful. But if you ask me, risking your family savings or your UPI balance over a fake installer is never worth it. Not even close. Stick to verified app stores and keep Play Protect turned on. And definitely tell your gaming squad to steer clear of these download traps.
