Spotting a Fake App Before You Install It

Why Fake Apps Still Reach Official Stores

Both the Google Play Store and Apple App Store operate review systems intended to catch malicious software before it reaches users. But those systems have gaps. How each platform reviews apps explains what those processes check for — and where they fall short. Attackers exploit these gaps through tactics like bait-and-switch updates (submitting a clean app, then pushing malicious code afterward), cloning legitimate apps with near-identical names and icons, or using automated tooling to pass initial screening.

The result: fake banking apps, counterfeit utility tools, and fraudulent games periodically make it into stores that most users trust by default. Spotting them before you install requires knowing what signals to look for — and taking a few minutes to actually check.

What to Check Before You Tap Install

Work through the checklist below before granting any app access to your device. These checks are especially important for financial apps, apps requesting sensitive permissions, and any app you found through an ad, social post, or unsolicited message rather than a direct store search.

Once you've confirmed an app looks legitimate, the next step is evaluating what it actually asks to access. See our permission and privacy checklist for a structured walkthrough of that process — and what to verify before accepting any permission request once you're inside the app for the first time.

When to Walk Away Entirely

Some scenarios warrant skipping the checklist and simply not installing. If an app was shared via a link in a message or email — rather than found directly in a store — treat it as high-risk by default. The same applies if you're being asked to install an APK file directly on Android outside the Play Store. Sideloading carries meaningful security trade-offs that are worth understanding before you bypass official distribution channels.

Fake apps frequently mirror the social engineering tactics used in other scams. The urgency and impersonation techniques behind phishing emails and tech support scams show up in fake app campaigns too — pressure to install immediately, claims of exclusive functionality, or warnings that your device is already compromised.

If an app fails more than two or three of the checks above, the risk typically outweighs the convenience. Legitimate developers can be contacted through official channels if you're uncertain about an app's authenticity.