Official app stores catch a lot of malicious apps, but not all of them, and impersonation apps designed to look like a popular real one slip through fairly regularly. A few minutes of checking before installing catches most of the risk.
Check the developer name, not just the app name and icon
Scam apps frequently copy a popular app's icon and name closely, but the listed developer name underneath is often subtly wrong — a misspelling, an unrelated company name, or something generic. Tap through to the developer's name and, if unsure, search it separately to confirm it matches the real company.
Look at install counts and review patterns
A banking or major brand app with only a few thousand downloads, when the real company has millions of users, is an immediate red flag. Also scan reviews specifically for complaints about unexpected charges, excessive permissions, or comments saying "this isn't the real app" — a pattern of similar complaints is more informative than the star rating alone, since fake apps sometimes pad ratings with bot reviews.
Check what permissions it asks for relative to its function
A simple flashlight or calculator app asking for contacts, SMS, or camera access has no legitimate reason to need that. Mismatched permissions relative to an app's stated purpose are one of the more reliable signs something is designed to harvest data rather than provide the function it claims.
Be extra cautious with apps outside official stores
Apps installed from outside the App Store or Google Play (sideloading, APK files from random websites) skip the platform's review process entirely. Unless you specifically know what you're doing and why, stick to official stores — the review process isn't perfect, but it does catch a meaningful share of obvious malware before it reaches most users.
Watch for apps that push you to disable security features
Any app that asks you to disable Play Protect, grant device administrator access, or install a "required" second app just to function is a serious warning sign. Legitimate apps don't need to disable your phone's built-in protections to work.
A quick check before installing anything unfamiliar
- Search the app and company name together to confirm the developer is legitimate.
- Compare install counts against what you'd expect for a well-known brand.
- Scan reviews for complaints about charges or impersonation, not just the star rating.
- Check requested permissions against what the app is supposed to do.
- Avoid sideloaded apps unless you specifically understand the risk.