Fake Mobile Apps: How Clone Apps Slip Into Google Play and the App Store

You search for a popular app, tap the first result, and install it. The icon looks right, the name is close enough, and there are thousands of reviews. What you actually downloaded was a clone built by a criminal group, and it now has permission to read your notifications, screenshot your screen, and forward your one-time passcodes.

Fake apps are not a fringe problem. Google removed more than 2.3 million policy-violating apps from Play in a recent year and blocked well over 150,000 developer accounts, and Apple rejects or removes hundreds of thousands of submissions annually. The ones that get through are the ones designed to look boring and legitimate for the first few weeks.

How Fake Apps Get Into Official Stores

Most people assume an app store review is a security guarantee. It is a filter, not a wall. Attackers get past it in a handful of predictable ways.

The dormant payload

The version submitted for review does nothing malicious. It is a working flashlight, PDF reader, or QR scanner. Days or weeks after approval, the app downloads its real code from a server the reviewers never saw. This is called a dropper, and it is the single most common technique in banking malware families.

The update swap

A developer builds a genuinely useful app, grows a real user base with real reviews, then sells the app or the developer account. The buyer pushes an update that adds tracking, ad fraud, or credential theft. Your phone installs it automatically overnight.

The near-miss name

The clone uses a name one character or one word off the real thing, copies the icon with a slightly different shade, and pastes the real app's screenshots. Search rankings do the rest. Wallet apps, streaming apps, and government service apps are the favourite targets.

Sideloading and third-party stores

On Android, an ad or a message can push you to install an APK directly. There is no review at all in that path. On iOS, the equivalent is a configuration profile or an enterprise certificate, usually delivered through a fake "beta access" or "investment platform" page.

What These Apps Actually Do

The goal is almost never to break your phone. It is to sit quietly and harvest.

• Overlay attacks. When you open your banking app, the malware draws a pixel-perfect fake login screen on top of it. You type your credentials into the attacker's window.
• Notification and SMS reading. This is how one-time passcodes get stolen. Your bank's 2FA text is intercepted before you finish reading it.
• Accessibility service abuse. Android's accessibility permissions were built for users with disabilities. Malware requests them to read screen content, tap buttons, and approve its own permission prompts.
• Subscription fraud. The app quietly signs you up for a premium service billed through your carrier or store account, then hides the confirmation messages.
• Ad fraud. Invisible ads load and click themselves in the background, burning your battery and mobile data to generate revenue for someone else.

Warning Signs Before You Install

Spend sixty seconds on these checks and you will catch the large majority of clones.

1. Check the developer name, not the app name. Tap the developer link and see what else they have published. A single-app developer with a generic name distributing a "bank" app is a red flag. Compare the developer name against the one listed on the company's official website.
2. Read the install count against the release date. Five million installs on an app first published three weeks ago does not happen organically.
3. Sort reviews by newest and most critical. Fake five-star reviews cluster in a short window and use short, generic phrasing. Real complaints about ads, charges, or crashes appear in the recent tail.
4. Look at the screenshots for language errors and for interface elements that do not match the current version of the real app.
5. Read the permission list before installing. A wallpaper app that wants SMS access, call logs, and accessibility services is not a wallpaper app.
6. Never install from a link in a message, ad, or email. Go to the store yourself and search, or follow the link from the company's official website.

Warning Signs After You Install

If a clone is already running, your phone will usually tell you before your bank does.

• Battery drains noticeably faster with no change in your usage.
• Mobile data usage spikes for an app that should barely use any.
• The phone runs warm while idle.
• Ads appear on your home screen or in other apps, outside the app that caused them.
• An app you installed has disappeared from the app drawer but still shows in Settings, or its icon changed.
• Screens flicker briefly when you open a banking or payment app, which is the overlay redrawing.
• You receive password reset or login codes you did not request.

How to Protect Yourself

Lock down the install path

On Android, open Settings > Apps > Special app access > Install unknown apps and set every entry to "Not allowed" unless you have a specific, current reason. This alone closes the sideloading route. Keep Google Play Protect enabled under Play Store > Profile > Play Protect.

On iOS, check Settings > General > VPN & Device Management. If there is a configuration profile or enterprise app you did not deliberately install for work or school, remove it.

Audit accessibility and notification access

On Android, go to Settings > Accessibility > Downloaded apps and to Settings > Notifications > Device & app notifications. Revoke anything you do not recognise or cannot justify. Legitimate apps rarely need either.

Move your codes off SMS

SMS-based two-factor authentication is the easiest thing for a malicious app to intercept. Switch your important accounts to an authenticator app or, better, a passkey or hardware security key. Even if a clone lands on your phone, it cannot read a code that never arrives as a message.

Keep the operating system current

Overlay and accessibility abuse are repeatedly restricted in new Android and iOS releases. An unpatched phone gives malware capabilities that a patched one has already taken away.

Review your installed apps quarterly

Open your app list and uninstall anything you have not opened in three months. Every dormant app is an update away from changing hands. Fewer apps is a smaller attack surface.

If It Already Happened

Act in this order, and do not skip the first step.

1. Put the phone in airplane mode to cut the app's connection while you work.
2. Boot into safe mode on Android (hold the power button, then long-press "Power off" and confirm). Safe mode disables downloaded apps, which lets you uninstall one that is blocking removal.
3. Revoke its device administrator and accessibility rights under Settings before uninstalling, since malware often uses these to prevent deletion.
4. Uninstall the app, then check for others installed on the same day.
5. Change passwords from a different device — a laptop, not the phone in question. Start with email, then banking, then everything reusing that password.
6. Call your bank and ask them to review recent transactions and add a verbal password to your account.
7. Check for unwanted subscriptions in your Play Store or App Store account and with your mobile carrier.
8. If anything still looks wrong, factory reset and restore apps manually rather than from a backup taken after the infection.

The Bottom Line

App store review catches most bad apps, but it was never designed to catch a clean app that turns malicious after approval. The check that actually protects you takes under a minute: verify the developer, read the recent negative reviews, and refuse any permission that does not match what the app claims to do. Combine that with disabling unknown-source installs and moving your two-factor codes off SMS, and a fake app on your phone stops being a catastrophe and becomes an inconvenience you can uninstall.