Father tricked into installing a malicious APK for a ₹5 medical appointment payment, what should we do?
My father booked an appointment at CMRI today over the phone. Some time later, he received a call from a number claiming to be related to the appointment and was asked to install an APK called Appointment_booking.apk and pay ₹5 through it.
He installed it and attempted the ₹5 payment, but it failed. They asked him to try again, which made him suspicious, so he uninstalled the app.
I checked the APK on VirusTotal and multiple major antivirus vendors flagged it as a banking trojan/spyware/trojan dropper.
As a precaution, I have:
Blocked the card he used
Told him not to use banking/UPI apps on that phone
Factory-reset the phone
What else should we do? Should we change his UPI PIN/banking passwords, contact the bank, or report it to 1930 even though the payment failed?
Also, is his phone/account safe after a factory reset, or could his credentials already be compromised?
Any advice would be appreciated.