Key Takeaways
- Almost every gaming-account loss starts with a download or a message, not a technical hack: a fake or modified APK, a phishing link, a fake "support agent" or a UPI request you were tricked into approving.
- Install only from the official download page. Any APK that promises "unlimited money", "hack", "mod" or "premium unlocked" is, in practice, a credential-stealing tool.
- You never enter your UPI PIN to receive money. A "refund" or "winnings" request that asks for your PIN is an attempt to take money from you.
- Genuine platforms do not ask you to pay a fee, tax or "unlock" deposit to a personal UPI ID to release winnings. That demand is the signature of an advance-fee scam.
- Never install a screen-sharing or remote-control app (AnyDesk, TeamViewer QuickSupport and similar) because someone on a call asked you to. It gives them your screen, your OTPs and your banking apps.
- If something goes wrong, speed matters: call your bank and the National Cyber Crime Helpline 1930 within the first hour, then file at cybercrime.gov.in.
Real money attracts attackers, and mobile gaming gives them an unusually good set of tools. The app is often installed as an APK file from outside the Play Store, promotion runs through WhatsApp groups and Telegram channels, payments move instantly over UPI, and players are excited, hurried or hoping to recover a loss. Put together, that is a near-perfect environment for social engineering.
The good news is that the scams players actually meet are not sophisticated. They follow a small number of repeating scripts, each with red flags you can learn to recognise in seconds. This guide describes those scripts, explains how each one works at a technical level (because a red flag is easier to trust once you understand what it is a sign of), gives you a 10-minute security checkup, and sets out exactly what to do in the first hour if you have already been caught out.
Why Gaming Players Are a Favourite Target
Four features of real-money gaming make it attractive to fraudsters, and none of them is about the games themselves.
- Money moves fast and can't be clawed back easily. A UPI transfer completes in seconds and is effectively irreversible without the recipient's cooperation. Scammers prefer payment methods where a mistake can't be undone.
- Many players install from outside the Play Store. Sideloading an APK means Google's normal app-store checks are not the first line of defence, so a look-alike file looks, on the surface, no different from the real one — as we cover in the APK download and install guide.
- Urgency and reward are built into the context. "Claim your bonus in the next 10 minutes" fits the rhythm of the platform so naturally that a fake version barely feels out of place.
- Losses create vulnerability. Players who have just lost money are the target of "recovery agent" and "guaranteed win" scams, which offer the one thing they want most at the moment they are least able to judge it.
comegame.co is an independent referral website, not the official platform, and the "Download" buttons on it lead to the platform's own download page. That independence is exactly why we recommend you verify links rather than trust any single source — including this one. Check where a button actually goes, and treat any copy of the app that didn't come from the official page as untrusted.
The Six Scams Players Actually Meet
The table below is the quick reference. Each of these is unpacked in its own section afterwards.
| Scam | How it works | Biggest red flag |
|---|---|---|
| 1. Fake or modded APK | A look-alike app steals your login and OTPs, or a "mod" hides malware | Downloaded from a link in a chat or a "mod" site, promising hacks or unlimited credit |
| 2. Phishing link | A copy of the login or bonus page collects your credentials | A slightly wrong domain and pressure to act within minutes |
| 3. Fake support agent | A stranger posing as support asks for OTPs, screen access or a "verification" payment | Support that contacts you first, or asks for a PIN or OTP |
| 4. UPI collect / "refund" scam | You approve a payment request believing you are receiving money | Being asked for your UPI PIN in order to receive funds |
| 5. Advance-fee "unlock" demand | You are told to pay a fee, tax or deposit to release a large "win" | Payment requested to a personal UPI ID or account |
| 6. Account takeover | Reused passwords or a hijacked SIM give attackers real access to your account | Unexpected OTPs, or your phone suddenly losing signal |
Scam scripts vary in detail, but nearly every one combines two ingredients: something that looks official and pressure to act before you can check.
Scam 1: Fake and Modded APKs
An APK is simply the installation package for an Android app, and nothing about the file format proves who made it. Anyone can take a legitimate app, alter it, and redistribute it under the same name and icon. That is what a fake or "modded" APK is, and it can do serious harm because Android gives an installed app whatever permissions you approve at install time.
What a malicious copy actually does
The most common goals are practical rather than dramatic:
- Credential capture. The fake shows a real-looking login screen and sends your mobile number and password to the attacker.
- OTP interception. If the app is allowed to read your SMS, it can forward one-time passwords to the attacker in real time, defeating the protection an OTP is meant to provide.
- Overlay attacks. With the "display over other apps" permission, a malicious app can draw a fake login box on top of your real banking or UPI app and capture what you type.
- Accessibility abuse. Accessibility services are designed to help users with disabilities and can read the screen and tap buttons. Malware that gains this permission can approve payments on your behalf.
Why "mod" and "hack" APKs are the worst offenders
A file promising unlimited money, guaranteed predictions or a "premium unlocked" version is asking you to trust an anonymous stranger with root-level access to your phone in exchange for something that is not possible. Real-money outcomes are decided on the platform's servers, so no app on your device can change them. The only thing such a file can realistically deliver is a way to take from you.
Download only from the official page
Reach the download page directly from the platform's official site, or from a link whose destination you have checked, not from a forwarded message or a search ad.
Keep Google Play Protect switched on
In Play Store settings, keep Play Protect enabled and allow it to scan apps, including those installed from outside the Play Store. It flags many known-malicious files.
Grant the install permission only to the app you used to download
Android asks for "Install unknown apps" per app (your browser or file manager). Once installed, switch that permission back off.
Review permissions at install and afterwards
A gaming app has no need for accessibility control, device-administrator rights or a "display over other apps" permission. Deny or revoke anything that doesn't obviously match what the app does.
Delete any other copy
If you have an older APK from a chat or another site, uninstall it and delete the file. Installing the real app over a fake one does not clean the phone.
Scam 2: Phishing Links and Look-Alike Sites
Phishing works by making you enter your details on a page the attacker controls. The page can be a pixel-perfect copy of a real login screen, so the design is never the giveaway. The address is.
How to read a web address in three seconds
The part of the address that decides who you are talking to is the domain — the section directly before the first single slash. Everything to the left of it is decoration an attacker can choose freely.
| Address pattern | What it tells you |
|---|---|
| comegame.co/blog | The domain is comegame.co. Everything after the first slash is a page on that domain. |
| comegame.co.bonus-claim.in | The real domain is bonus-claim.in. "comegame.co" is just a subdomain label the attacker chose. |
| come-game-app.xyz | A different domain that merely uses similar words. Unfamiliar endings like .xyz or .top are worth extra suspicion. |
| comegarne.co | A one-letter swap ("rn" for "m") designed to be missed at a glance. |
| bit.ly/xxxx or another shortened link | The destination is hidden. Long-press or use a link-preview tool before opening anything you didn't request. |
The padlock symbol only means the connection is encrypted, not that the site is honest — attackers can and do get HTTPS certificates for fake domains.
Three habits defeat most phishing: type or bookmark the addresses you actually use rather than tapping links in chats; treat any message that rushes you ("expires in 10 minutes", "last chance") as suspicious by default; and never enter a password, OTP or UPI PIN on a page you reached from a message rather than from the app itself.
Scam 3: Fake Support Agents and "Recovery" Offers
This scam relies on a single reversal: you are supposed to contact support, so when "support" contacts you, that should already feel wrong. The scam usually takes one of three forms.
- The unsolicited "KYC expired" or "account suspended" message. It arrives by SMS, WhatsApp or Telegram, with a link or a phone number, and warns that your account will be closed unless you "re-verify" immediately.
- The helpful stranger in a group. After you post a problem in a public chat or comment section, someone quickly offers to "sort it out" and moves you to a private message, where they ask for a screenshot of your account or an OTP.
- The recovery agent. After you mention a loss, someone claims they can recover it — for an upfront fee. No one can reverse a legitimate loss, and the fee is the entire scam.
Genuine support only ever needs your registered details, the amount, the time and the transaction reference (UTR) of a specific payment. It never needs your UPI PIN, an OTP, your card's CVV, or remote access to your phone. If a message asks for any of those, you are not talking to support.
Screen-sharing apps are a special case
If anyone asks you to install AnyDesk, TeamViewer QuickSupport or any similar app "so they can fix the problem", stop and end the call. These tools hand the other person live control of your screen. From there they can read incoming OTPs, open your banking and UPI apps, and approve transfers while you watch — and you would be the one who technically authorised each step. No legitimate gaming support process requires it.
Scam 4: UPI "Collect Request" and Refund Traps
UPI has a feature that lets a payee request money from you. It has legitimate uses — a shop can send a bill to your app — but it is also the basis of the most repeated payment trick in India.
The hook
Someone says they will send you money — a refund, a winning, a "bonus transfer", or a payment for something you listed for sale.
The request
Instead of sending money, they send a "collect request" or a QR code. Your UPI app shows a prompt that looks like an incoming payment.
The PIN prompt
You are told to "enter your PIN to receive the money". Entering it approves a payment from your account.
The defence is a single rule that is always true: entering your UPI PIN authorises money leaving your account; receiving money never requires it. Any prompt that asks for your PIN in order to get paid is either a mistake in your understanding or a scam, and both are solved by cancelling. Also read the payee name and amount on every screen — the app shows who you are paying, and the name is often the first thing that doesn't match the story.
Scam 5: The Advance-Fee "Unlock" Demand
This one targets people who have genuinely won, or believe they have. A message or a "support agent" says your withdrawal is ready but held — and can be released once you pay a "tax", "GST", "verification deposit", "anti-money-laundering fee" or "security deposit". The amount is usually modest compared with the claimed winnings, which is what makes it tempting. Payment is requested to a personal UPI ID or a bank account, not through the platform.
Three facts dismantle it. First, a genuine platform releases withdrawals from your own account through its normal payout flow, without asking you to send money to a third party. Second, any tax that applies to winnings is handled by the operator as part of the payout, not collected by a stranger's UPI ID. Third, after you pay once there is always a second fee — the scam has no natural end because the "winnings" never existed. If someone asks you to pay to receive money, walk away, whatever they say the alternative costs you.
🔒 Get the App From the Official Page
Skip forwarded links and mod sites. The official Come Game download is one tap away — new members also get a ₹10,000 welcome bonus on their first UPI deposit, subject to terms.
Scam 6: Account Takeover Through Weak Passwords and SIM Hijacking
Not every attack needs you to make a mistake in the moment. Two quieter routes lead to the same result.
Reused passwords
Data breaches on unrelated websites leak millions of email-and-password pairs. Attackers try them against gaming, banking and payment apps, betting that you reused one. If your Come Game password is the same as your password for anything else, a breach elsewhere becomes a breach here. A long, unique password stored in a password manager removes this risk entirely.
SIM swap and number hijack
Because OTPs travel over SMS, control of your phone number is control of your accounts. In a SIM-swap attack, a fraudster convinces a telecom provider to move your number to a new SIM. Warning signs are a sudden loss of signal on a phone that was working, plus unexpected OTPs or "SIM change" messages. To reduce the risk, keep your mobile number's account details with your operator private, set a SIM PIN, and check the government's Sanchar Saathi portal now and then to see which mobile connections are registered against your identity.
Your 10-Minute Security Checkup
None of the following needs technical skill, and together they close off the routes described above.
Set a unique password
Use a long passphrase you don't use anywhere else, ideally saved in a password manager. Change it now if it was ever reused.
Turn on Play Protect and update Android
Security patches close the holes that malware uses. Enable automatic updates and keep Play Protect scanning on.
Audit permissions
Go through Settings → Apps and check which apps have accessibility, device-admin or "display over other apps" access. Remove anything you don't recognise or need.
Lock the phone and the apps
Use a screen lock, and add an app lock or fingerprint requirement to your UPI and banking apps, so a stolen or borrowed phone can't approve payments.
Secure your SIM
Set a SIM PIN, and ask your operator about extra verification for SIM changes. Check Sanchar Saathi for connections registered in your name.
Set UPI transaction limits
Most UPI apps and banks let you lower your daily transfer limit. A modest limit caps the damage from any single mistake.
Save the right numbers now
Store your bank's fraud helpline and the National Cyber Crime Helpline (1930) in your phone so they are a tap away when time matters.
Genuine Contact vs Scam Contact: A Quick Comparison
| Genuine platform contact | Scam contact | |
|---|---|---|
| Who starts it? | Usually you, through the app or the official contact page | A stranger, unprompted, or a "helper" who appears after you post a problem |
| What is asked for? | Registered details, amount, time and UTR of a specific transaction | UPI PIN, OTP, card CVV, remote access, or a "fee" |
| Where does money go? | Payouts return to your own verified account | Payment to a personal UPI ID or unfamiliar account |
| Tone | Calm, with time to check | Urgent, with countdowns and threats of closure |
| Where does the link lead? | The platform's real domain | A look-alike or shortened address |
If Something Goes Wrong: The First Hour
If you have already paid, approved a request or shared a code, the next 60 minutes matter more than anything you do later. Speed improves the chance that funds can be traced or held, so act in order and don't spend time on embarrassment.
Call your bank and block the channel
Use the fraud helpline printed on your card or app. Ask them to block the UPI handle or card and flag the transaction as fraudulent.
Call 1930 and file at cybercrime.gov.in
Report to the National Cyber Crime Helpline on 1930 and register the complaint on the national cyber-crime portal. Early reports give the best chance that a receiving account can be flagged.
Preserve evidence
Screenshot the chat, the payee name, the UPI ID, the UTR, the amount, the time and any links. Don't delete the conversation.
Contain the phone
Uninstall the suspicious app, remove any screen-sharing tool, run a Play Protect scan and change passwords from a clean device. If you gave someone remote access, consider a factory reset.
Tell the platform
Contact the official support with the details so any linked account activity can be reviewed, and change your account password.
Consider a police complaint
For larger amounts, file a written complaint at your local police station or cyber cell and keep the acknowledgement number.
People who have just been defrauded are often contacted by "recovery agents" offering to get the money back for a fee. They are a second layer of the same fraud. Recovery goes through your bank, the helpline and the police — never through a paid stranger.
Playing Responsibly and Staying Secure
Security and responsible gaming overlap more than they seem to. Scammers thrive on urgency, frustration and the wish to recover a loss — the same states that make it harder to stick to a budget. A pre-set deposit limit is a security control as well as a wellbeing tool, because it caps how much can leave your wallet on a bad day, whoever is pressing the buttons. The deposit limits and session timers guide takes about ten minutes, and the UPI-specific habits in our payments guide pair naturally with the steps above.
Real-money gaming is restricted in Andhra Pradesh, Assam, Odisha, Telangana, Nagaland and Sikkim, and is strictly for adults 18 and over everywhere else. For support tools and helplines, see the responsible gaming page.
The Bottom Line
You do not need to be technical to stay safe. You need a small number of habits that are always the same: install only from the official page, never share a PIN or OTP, treat unsolicited contact as suspicious, never pay a stranger to receive money, and act within the first hour if something goes wrong. Nearly every incident described in this guide fails against one of those five rules.
The most useful mental shift is to stop asking "does this look real?" — because a fake can be made to look identical — and start asking "what is this asking me to do?" Real platforms ask you to play, deposit or withdraw through their own app. Scams ask you to send, approve, install or share. That single difference is the fastest check you have.
