The assumption that an app from an official store is automatically safe is the most effective prerequisite for this type of fraud. Both major stores review applications, but they don't examine every update with the same depth, and they don't detect every fake. Wallet and trading apps that mimic well-known providers regularly appear.<\/p>\n\n\n\n
For victims, the damage is usually immediate. A fake wallet app asks for the recovery phrase upon first launch. Anyone who enters it relinquishes complete control of their funds. With fake trading apps, the process is slower: deposits are accepted, the balance grows, and withdrawals are repeatedly thwarted by ever-changing conditions.<\/p>\n\n\n\n
Crypto Investigation covers both variants. This article shows how such applications get into the app stores, how to identify them before installation, and what to do after installation.<\/p>\n\n\n\n
The most common route involves an inconspicuous initial version. The application is submitted as a harmless tool, such as a course overview or calculator, and passes the review. The malicious function is introduced with a later update or is loaded via content that is only delivered after approval.<\/p>\n\n\n\n
A second method involves taking over existing developer accounts that have been purchased or compromised. Applications running under such accounts appear established because the account has a history. A third method is name similarity: The application has a name almost identical to the original, uses a similar icon, and incorporates familiar terms in its description to appear in search results.<\/p>\n\n\n\n
This content is also being distributed outside of app stores. Links from chat groups lead to installation files or configuration profiles that allow applications to be installed without verification. If someone tells you that you need to change a specific setting to install the app, that's the moment to stop.<\/p>\n\n\n\n
Look at the developer name and compare it to the information on the provider's official website. Check which other applications appear under that name. A developer with only one recently released app is a contradiction for a supposedly established provider.<\/p>\n\n\n\n
It's not the average rating that counts, but the pattern. Many very short reviews in a short period, uniform wording, and a rating profile that only emerged after the last update are striking. Pay particular attention to the negative reviews; they often contain the first indications of blocked payouts.<\/p>\n\n\n\n
The safest way is via the provider's official website, which you should visit yourself, and the link provided there. Do not search for the name in the app store, as paid placements and similarly named apps tend to appear higher up. Do not open links from chats, emails, or advertisements.<\/p>\n\n\n\n
A wallet app does not need access to accessibility features, permission to read notifications, to overlay other applications, access to text messages, or access to your contacts. If such permissions are requested, cancel the application. These rights allow the app to intercept your input and steal verification codes.<\/p>\n\n\n\n
If an application asks for your recovery phrase, the verification is complete. No reputable wallet or exchange will ever request this phrase in an app, on a form, or from an employee. The same applies to being asked to photograph or upload the phrase.<\/p>\n\n\n\n
If you only installed the app without entering any data, uninstall it, but first save screenshots of the store entry showing the developer's name. Then check the permissions granted and revoke them.<\/p>\n\n\n\n
Once you've entered your recovery phrase, it's considered compromised. Immediately create a new wallet on a different, trusted device and transfer all remaining funds to it, starting with the largest amount. We describe in detail the necessary steps and their order in this situation in our article on [topic missing]. stolen seed phrase<\/a>.<\/p>\n\n\n\n If you have deposited funds into a fake trading app, stop making further payments, even if your balance appears high. Save your dashboard, all communications, and all transaction IDs, including date, time, and amount.<\/p>\n\n\n\n In all cases: Report the app to the app store, file a police report, and inform the exchange through which you deposited funds. Also, check if other accounts on the device might be affected and change the login credentials for those accounts from a different device.<\/p>\n\n\n\n You've installed an app and are unsure whether it's fake, or if funds have already been stolen? We'll assess the store listing, track stolen funds, and check if the destination addresses are known from other cases.<\/p>\n\n\n\n Use the form for the free initial assessment<\/a> on our website. Screenshots of the store listing, your affected addresses, and the transaction IDs of the outflows are helpful.<\/p>\n\n\n\n Not automatically. Both stores check, but counterfeits regularly slip through, often via inconspicuous initial versions with malicious functionality added later, or via compromised developer accounts.<\/p>\n<\/div><\/div>\n\n\n\n The question about the recovery phrase is problematic. No reputable wallet requires this phrase in its app. This question alone is enough to classify the application as a fake.<\/p>\n<\/div><\/div>\n\n\n\n Access to accessibility features, notification reading, overlaying on other apps, access to text messages and contacts. None of this is required for a wallet.<\/p>\n<\/div><\/div>\n\n\n\n Via the provider's official website, which you accessed yourself in your browser, and the link provided there. Searching in the app store often leads first to advertisements and similarly named applications.<\/p>\n<\/div><\/div>\n\n\n\n Not much if they were created in a short period of time, are very brief, and are similar. Negative reviews and whether the profile was created after the last update are more informative.<\/p>\n<\/div><\/div>\n\n\n\n Treat them as compromised. Immediately create a new wallet on a different device and transfer any remaining funds there. Then secure evidence and to file charges<\/a>.<\/p>\n<\/div><\/div>\n\n\n\n No. Deleting the application removes it, but not the consequences of a previously submitted recovery phrase. Also, be sure to take screenshots of the store entry beforehand as evidence.<\/p>\n<\/div><\/div>\n\n\n\n It can detect known malware, but it doesn't replace checking the store entry. If a more serious infection is suspected, reinstalling the device is the safer course of action.<\/p>\n<\/div><\/div>\n\n\n\n Because no store check takes place there, and because a link from a trusted group is less likely to be questioned. You should generally avoid opening installation files and configuration profiles from chats.<\/p>\n<\/div><\/div>\n\n\n\n Yes. The store entry, developer name, and the destination addresses of the outflows are concrete points of reference. They often appear in multiple instances and help in identifying a structure.<\/p>\n<\/div><\/div>\n\n\n\n Further articles on this topic: Wallet Drainer<\/a>, Sweeper Bot<\/a> as well as How to recognize crypto fraud<\/a>.<\/p>\n\n\n\n Note: This article is for general information purposes only and does not replace legal advice in individual cases. Crypto Investigation is a forensic service provider and not a law firm.<\/em><\/p>","protected":false},"excerpt":{"rendered":" Even official app stores contain fake wallet and trading apps. Here's how to spot them, which permissions are a giveaway, and what to consider after installation.<\/p>","protected":false},"author":4,"featured_media":239319,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-9008","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-allgemein"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tHave suspected fake apps checked<\/h2>\n\n\n\n
FAQ: Fake crypto apps<\/h2>\n\n\n\n
Are apps from official stores safe?<\/h3>
How can I immediately recognize a fake wallet app?<\/h3>
Which permissions are suspicious?<\/h3>
How do I find the real app?<\/h3>
What do many good reviews mean?<\/h3>
I've entered my recovery phrase, now what?<\/h3>
Is it enough to delete the app?<\/h3>
Can a virus scanner help?<\/h3>
Why are such apps being distributed in chat groups?<\/h3>
Is it worth filing a complaint?<\/h3>