How to spot fake apps on Google Play before you install

Google Play is the safest place to get Android apps, but it isn't perfect. In October a fake WhatsApp Messenger reportedly reached more than 500,000 downloads and appeared in a sponsored slot above the real app, days after a fake Chrome listing was found (our report). Clones like these copy the icon, screenshots and description, so they look right at a glance. The good news is that a few checks, which take under a minute, expose almost all of them.

Why fake apps get through

Every app on Google Play goes through automated and human review, and Google Play Protect scans apps on your phone. Scammers still find gaps: they submit a harmless-looking version and change it later, buy search ads so their listing appears first, or copy a popular brand's store page word for word. Some clones simply show ads or harvest data; others try to steal passwords, one-time codes or bank details. The aim is always the same: get you to tap Install before you look closely.

Check 1: the developer name

Directly under the app name, Google Play shows the developer. This is the single most useful check.

• The real WhatsApp is published by WhatsApp LLC, Chrome by Google LLC, and a bank app by the bank itself.
• Tap the developer name to see its other apps. A brand-new account with one app, or a developer that publishes wallpapers, VPNs and "messengers" together, is a warning sign.
• Scroll to App support on the listing: a genuine company lists its real website and a support email on its own domain, not a free webmail address.

Check 2: ads above the real result

Search results can include paid placements marked Sponsored or Ad. Most are legitimate, but this slot is exactly where the reported WhatsApp clone appeared. If you search for a well-known app, scroll past the ad and make sure you open the listing that matches the right developer.

Check 3: downloads, reviews and age

Big apps leave a big footprint. The real WhatsApp shows billions of downloads and hundreds of millions of reviews; a clone with the same icon but a few thousand reviews is not the real thing. Also:

• Read the newest reviews (sort by most recent), not just the star rating. Many one-star reviews saying "fake", "asks for payment" or "not the real app" are a clear signal.
• Be careful when reviews are missing. Android Authority noted that the fake WhatsApp may have used Google Play's Early Access programme, which hides public reviews.
• Check About this app for the release date and update history. A "major" app that appeared last week is suspicious.

Check 4: screenshots, text and spelling

Copycats often reuse the real screenshots, so good images prove little. Look instead for odd spelling, awkward wording, mismatched logos and promises the real app wouldn't make ("free premium", "see who viewed your profile", "unlock any account"). Also compare the app size and the "Contains ads" label: a lightweight clone of a big app that suddenly contains ads is a red flag.

Check 5: Data safety and permissions

Every listing has a Data safety section where the developer says what it collects and shares. It's self-reported, but a flashlight or wallpaper app claiming to collect your contacts, messages or location tells you plenty.

After installing, Android asks for sensitive permissions one by one. Say no to anything that doesn't fit the app, and be especially wary of requests to turn on an Accessibility service, become a device admin, or display over other apps. Those powers can be abused to read the screen, intercept codes or block uninstalling. You can review everything later in Settings → Apps → app → Permissions (menu names vary slightly by phone maker).

Check 6: keep Play Protect on

Google Play Protect is built into Android phones with Google services. Open the Play Store, tap your profile picture → Play Protect, make sure scanning is on and run Scan if you're unsure about something you installed. It won't catch everything, so treat it as a safety net, not a replacement for the checks above. Also keep Install unknown apps switched off for browsers and messaging apps, so a link in a chat can't install an APK from outside the store.

If you already installed a fake app

1. Uninstall it. If Android won't let you, check Settings → Security → Device admin apps (location varies) and remove its admin rights first.
2. Run a Play Protect scan.
3. Change passwords you typed into it, starting with email and banking, and turn on two-step verification.
4. If you entered card or bank details, call your bank straight away.
5. Report the listing: on the app's Play Store page, open the three-dot menu and choose Flag as inappropriate.

Scam protection on Android goes beyond the store, too: see the new scam shields in Google Messages, and if you're setting up a new phone, our eSIM explainer covers moving your number safely.