The assumption that an app from an official store is automatically safe is the most effective prerequisite for this type of fraud. Both major stores review applications, but they don't examine every update with the same depth, and they don't detect every fake. Wallet and trading apps that mimic well-known providers regularly appear.
For victims, the damage is usually immediate. A fake wallet app asks for the recovery phrase upon first launch. Anyone who enters it relinquishes complete control of their funds. With fake trading apps, the process is slower: deposits are accepted, the balance grows, and withdrawals are repeatedly thwarted by ever-changing conditions.
Crypto Investigation covers both variants. This article shows how such applications get into the app stores, how to identify them before installation, and what to do after installation.
The most important information at a glance
- As a general rule: No reputable provider will ask for your recovery phrase in an app. This request is the clearest indication of a fake.
- Ways into the store: Disguised first versions, later updates with malicious functionality, purchased developer accounts and imitated names.
- Checkpoints: Developer name, release date, rating profile, linked website, number of downloads.
- Permissions: Access to accessibility features, reading notifications, and display over other apps are not required for wallets.
- After installation: Every minute counts when entering the recovery phrase. Any remaining funds will be transferred immediately to a new wallet.
- Evidence: Save the store listing, developer name, and screenshots before removing the application.
How fake crypto apps get into the stores
The most common route involves an inconspicuous initial version. The application is submitted as a harmless tool, such as a course overview or calculator, and passes the review. The malicious function is introduced with a later update or is loaded via content that is only delivered after approval.
A second method involves taking over existing developer accounts that have been purchased or compromised. Applications running under such accounts appear established because the account has a history. A third method is name similarity: The application has a name almost identical to the original, uses a similar icon, and incorporates familiar terms in its description to appear in search results.
This content is also being distributed outside of app stores. Links from chat groups lead to installation files or configuration profiles that allow applications to be installed without verification. If someone tells you that you need to change a specific setting to install the app, that's the moment to stop.
Detecting fake crypto apps: Checkpoints before installation
Developers and history
Look at the developer name and compare it to the information on the provider's official website. Check which other applications appear under that name. A developer with only one recently released app is a contradiction for a supposedly established provider.
Ratings in the sample
It's not the average rating that counts, but the pattern. Many very short reviews in a short period, uniform wording, and a rating profile that only emerged after the last update are striking. Pay particular attention to the negative reviews; they often contain the first indications of blocked payouts.
The path to the app
The safest way is via the provider's official website, which you should visit yourself, and the link provided there. Do not search for the name in the app store, as paid placements and similarly named apps tend to appear higher up. Do not open links from chats, emails, or advertisements.
Permissions
A wallet app does not need access to accessibility features, permission to read notifications, to overlay other applications, access to text messages, or access to your contacts. If such permissions are requested, cancel the application. These rights allow the app to intercept your input and steal verification codes.
The unambiguous signal
If an application asks for your recovery phrase, the verification is complete. No reputable wallet or exchange will ever request this phrase in an app, on a form, or from an employee. The same applies to being asked to photograph or upload the phrase.
What to do after installing a fake app
If you only installed the app without entering any data, uninstall it, but first save screenshots of the store entry showing the developer's name. Then check the permissions granted and revoke them.
Once you've entered your recovery phrase, it's considered compromised. Immediately create a new wallet on a different, trusted device and transfer all remaining funds to it, starting with the largest amount. We describe in detail the necessary steps and their order in this situation in our article on [topic missing]. stolen seed phrase.
If you have deposited funds into a fake trading app, stop making further payments, even if your balance appears high. Save your dashboard, all communications, and all transaction IDs, including date, time, and amount.
In all cases: Report the app to the app store, file a police report, and inform the exchange through which you deposited funds. Also, check if other accounts on the device might be affected and change the login credentials for those accounts from a different device.
Have suspected fake apps checked
You've installed an app and are unsure whether it's fake, or if funds have already been stolen? We'll assess the store listing, track stolen funds, and check if the destination addresses are known from other cases.
Use the form for the free initial assessment on our website. Screenshots of the store listing, your affected addresses, and the transaction IDs of the outflows are helpful.
FAQ: Fake crypto apps
Are apps from official stores safe?
Not automatically. Both stores check, but counterfeits regularly slip through, often via inconspicuous initial versions with malicious functionality added later, or via compromised developer accounts.
How can I immediately recognize a fake wallet app?
The question about the recovery phrase is problematic. No reputable wallet requires this phrase in its app. This question alone is enough to classify the application as a fake.
Which permissions are suspicious?
Access to accessibility features, notification reading, overlaying on other apps, access to text messages and contacts. None of this is required for a wallet.
How do I find the real app?
Via the provider's official website, which you accessed yourself in your browser, and the link provided there. Searching in the app store often leads first to advertisements and similarly named applications.
What do many good reviews mean?
Not much if they were created in a short period of time, are very brief, and are similar. Negative reviews and whether the profile was created after the last update are more informative.
I've entered my recovery phrase, now what?
Treat them as compromised. Immediately create a new wallet on a different device and transfer any remaining funds there. Then secure evidence and to file charges.
Is it enough to delete the app?
No. Deleting the application removes it, but not the consequences of a previously submitted recovery phrase. Also, be sure to take screenshots of the store entry beforehand as evidence.
Can a virus scanner help?
It can detect known malware, but it doesn't replace checking the store entry. If a more serious infection is suspected, reinstalling the device is the safer course of action.
Why are such apps being distributed in chat groups?
Because no store check takes place there, and because a link from a trusted group is less likely to be questioned. You should generally avoid opening installation files and configuration profiles from chats.
Is it worth filing a complaint?
Yes. The store entry, developer name, and the destination addresses of the outflows are concrete points of reference. They often appear in multiple instances and help in identifying a structure.
Further articles on this topic: Wallet Drainer, Sweeper Bot as well as How to recognize crypto fraud.
Note: This article is for general information purposes only and does not replace legal advice in individual cases. Crypto Investigation is a forensic service provider and not a law firm.
