If you've searched "EPFO passbook download" or "check PF balance app" on Google Play recently, there's a real chance you've seen a fake EPFO passbook app designed to look exactly like the official government interface. These cloned apps are among the more dangerous scams circulating in 2026, specifically targeting salaried Indians who just want to check their provident fund balance before a withdrawal or job change.
The timing matters. EPFO is actively rolling out UPI-based PF withdrawals, with Financial Express confirming in early 2026 that the launch is imminent. That's driven a spike in searches for EPFO apps. Fraudsters spotted this. They've been flooding Play Store search results and third-party APK sites with scam clones for months. Our scam alerts section has been tracking this pattern of attackers going after government service impersonation, and the EPFO scam is one of the more organized ones we've seen.
What this scam actually is
The fake app looks almost identical to the official UMANG app, available at umang.gov.in. Same colors, same login screen. Once you enter your UAN (Universal Account Number), password, or Aadhaar-linked details, that information goes straight to a fraud network. Not to your employer. Not to EPFO. Gone.
Some versions go further. They ask for your Aadhaar OTP during so-called "verification" and use it to submit a withdrawal claim on the actual EPFO portal. In 2026, with EPFO's improved online withdrawal flows, an OTP combined with your UAN is sometimes enough to push a claim through without extra checks (which makes sense, actually, given how much EPFO has automated in the last two years).
The Rs 70 crore fraud at an EPFO Credit Society in Bengaluru, where two people were arrested this year, shows how organized this has become. These aren't random opportunists running one-off tricks. There are coordinated networks behind this, with fake app infrastructure and manufactured Play Store reviews that have been running for months.
How the fake EPFO app scam works, step by step
Understanding the mechanics makes it easier to catch before it's too late.
- You search for an EPFO passbook or PF balance app on Google or the Play Store. Scam apps appear high in results because fraudsters run paid ads or use keyword stuffing. Many carry dozens of fake five-star reviews with generic text like "very helpful app."
- You download and install it. The interface mimics the UMANG login screen closely enough that most people don't notice anything wrong on first look.
- You type in your UAN and password. The app shows a "wrong password" error, prompting you to try again. Either way, your credentials are now captured and transmitted to a remote server.
- The Aadhaar OTP request arrives. The app claims this is needed to "sync your account" or "complete eKYC verification." This is the most dangerous step. With your Aadhaar OTP, they can authenticate a withdrawal claim on the real EPFO portal.
- Some variants skip the OTP entirely and ask for your bank account number and IFSC code directly, saying they need it to "update your withdrawal account details."
- A PF withdrawal claim gets submitted in your name. Standard processing takes 3 to 7 working days, which means you might not realize anything happened until the money has already moved.
There's also a scam that skips the app entirely. You get an SMS or WhatsApp message saying your EPFO KYC has expired, with a link to download an APK file directly. That APK typically installs spyware that reads your SMS inbox, capturing OTPs from any app on your phone. Not just EPFO-related ones. I think this variant is actually more dangerous because most people don't connect a random SMS to a PF theft until it's done.
Warning signs to check before you install anything
Before you enter any credentials, run through this quickly.
- The publisher name on Play Store isn't "National e-Governance Division, MeitY" — that's the only legitimate publisher for UMANG and official central government apps
- The app has under 50,000 downloads or was published or updated very recently with no history
- It asks for your Aadhaar OTP to view a passbook — the real UMANG app doesn't need this for a basic balance check
- The app requests SMS, camera, or microphone permissions for something that's just supposed to show a PDF document
- You found it via an SMS link, a WhatsApp forward, or a Google ad rather than navigating directly to umang.gov.in
- Minor visual glitches on the login screen: slightly wrong fonts, off-color buttons, odd spelling in menu labels
CERT-In, India's national cybersecurity agency, has flagged government app impersonation as a persistent high-risk attack. Their advisories at cert-in.org.in cover fake portal cloning specifically. Honestly, worth bookmarking if you handle government services for your family or at work.
The UPI factor that makes 2026 especially risky
EPFO is rolling out instant PF withdrawal via UPI, confirmed by the government and reported by Financial Express in early 2026. Once that goes live, the gap between credential theft and money movement could shrink from days to minutes.
Right now, a PF withdrawal takes 3 to 7 working days. EPFO officers sometimes catch suspicious claims during manual review. UPI settlement is near-instant. The fraudsters targeting EPFO credentials today are building their account lists ahead of that launch. It's a longer game, but a calculated one. If you ask me, the window to fix this at the infrastructure level is closing fast.
As NDTV Profit reported in their coverage of EPFO third-party agent scams, the common denominator in most cases is people handing over credentials to someone they shouldn't have trusted. A fake app is just a more automated version of that same problem, running at scale.
How to protect your PF balance
Only use UMANG. Go to umang.gov.in, find the app link there, and verify the Play Store publisher says "National e-Governance Division, MeitY." There is no separate official EPFO passbook app. The government hasn't released one.
Use the web portal directly. unifiedportal-mem.epfindia.gov.in works fine in a mobile browser. It's not the most polished interface, but it's safe. Bookmark it now.
Enable SMS alerts on your UAN-linked mobile number. Your registered number should get a notification when any withdrawal claim is submitted. If you get one you didn't initiate, call EPFO at 1800-118-005 immediately and ask them to flag the account.
Never share your Aadhaar OTP with any app just to view your PF passbook. That is not how any of this works. If an app asks for it, close the app and report it.
Lock your Aadhaar biometrics via the mAadhaar app when you're not actively using them for transactions. This blocks biometric-based authentication on your Aadhaar, which is one route used for unauthorized PF withdrawal claims (annoying extra step, I know, but it takes about thirty seconds). Our guides section has a step-by-step walkthrough of the locking process if you haven't done it yet.
Check your PF balance once a month. SMS "EPFOHO UAN ENG" to 7738299899 for a quick update without opening any app. Catching an unauthorized claim early, before it processes, sometimes gives you a window to cancel it.
And don't install APK files from outside Play Store or the App Store for anything government-related. That one habit eliminates most of this risk entirely.
What to do if you've already been scammed
If you've entered your credentials into a suspicious app, don't wait to see what happens next.
- Log into unifiedportal-mem.epfindia.gov.in immediately and change your UAN password
- Call EPFO's helpline at 1800-118-005 to flag your account for suspicious activity and ask about any pending claims
- File a complaint at cybercrime.gov.in or call the National Cyber Crime Helpline at 1930, free and available 24/7
- If a claim has already been submitted, specifically ask EPFO to freeze or cancel it. The 3 to 7 day processing window sometimes allows this
- File an FIR at your nearest police station or cybercrime cell. Keep a copy of the complaint number for follow-up
The Economic Times reported in 2026 that the Indian government issued specific warnings to railway pensioners and salaried employees about fraudsters impersonating EPFO and pension portal officials. The official advice: verify every communication through official channels before acting on it.
Time genuinely matters here. A claim that's been submitted but not yet processed can sometimes be stopped. One that's been paid out is much harder to recover, and EPFO's dispute resolution process is slow.
The third-party agent problem is the same scam in a different coat
Even if you avoid fake apps completely, there's a parallel issue worth knowing about. Plenty of people hire "PF agents" found on Facebook groups or housing society WhatsApp chats, who promise faster withdrawals for a fee of Rs 500 to Rs 2,000. These agents sometimes legitimately process your claim, but they keep your UAN login details for future use. NDTV Profit's reporting on third-party EPFO fraud confirms this is widespread, particularly among migrant workers who find the English-language portal difficult to navigate.
EPFO's own portal is free and works well in 2026. It also has a Hindi interface. You don't need an agent. Check our explainers section for a plain-language walkthrough of filing a PF withdrawal claim yourself, without handing your credentials to anyone.
Your provident fund is years of contributions. Some of you reading this have a decade or more saved up in there. It's not money you can quickly rebuild if it disappears. The fake app scam is targeted and getting more sophisticated as EPFO's digital systems improve. A bit of paranoia about what you install is genuinely the cheapest protection you have.
