Fake Apps: Checking Before You Install

A fake crypto app does not need to break encryption. It needs you to type your seed phrase into a screen that looks almost right, and clones of popular wallets do exactly that with the same logo, the same colours and a near-identical name.

Most of these apps reach a phone through a link rather than through a store search, which means the familiar “only install from official stores” advice covers less ground than people assume. Checking before you install is a five-minute process, and this guide sets out what a fake crypto app actually does, which signals are reliable, and which ones are theatre.

• Store presence is not verification. Listings can be cloned, and a stolen brand is easy to render. The publisher identity is the check that matters, not the icon.
• Download counts and star ratings are weak signals. Both can be manufactured cheaply, and a cloned listing can inherit a familiar look without inheriting any history.
• The install link is the attack surface. A link delivered by message, advertisement or search result is the most common route, because a fake crypto app only has to be convincing once.
• Any app that asks for a seed phrase is hostile. Legitimate wallets generate or import a phrase on the device. They do not ask you to type an existing one into a web form or a support chat.

How a fake crypto app gets onto a phone

It gets there because you installed it, and the request usually arrives when you are already looking for something. The common routes are a direct message with a link to a beta, an advertisement placed above a genuine search result, a cloned website with a download button, and an enterprise or profile-based install that bypasses the store entirely.

Each route exploits the same gap: the user checks that the app looks right, and nobody checks who signed it. On mobile operating systems the signing identity is the one thing a clone cannot copy, which is why it belongs at the centre of any pre-install check.

Signals that are worth checking before install

Four checks carry most of the weight, and all four can be done before the app is opened.

Check the publisher, not the name

Store listings show a developer or publisher name beneath the app title. A clone typically uses a variation: an extra word, a different capitalisation, a generic studio name, or a symbol inserted into the name that renders almost identically on a small screen.

Compare the publisher string to the one named on the project’s own official website, reached by typing the domain rather than following a link. If the two do not match exactly, stop. That single comparison defeats most clones.

Check how the app is being distributed

A legitimate wallet for a mainstream platform is normally distributed through the platform’s own store. An install that requires approving a profile, enabling an unknown-source setting, or joining a beta programme is not automatically malicious, but it removes the only review layer that exists.

Direct downloads from a website are the highest-risk path. If the official site offers one, verify the file checksum where the project publishes one, and treat any download that skips that step as unverified.

Check requests made during onboarding

Onboarding is where a fake crypto app reveals itself. A genuine self-custody wallet creates a new phrase locally or accepts an existing one through a device-side import. A clone asks you to enter an existing phrase into a form, or offers to “validate” or “sync” a wallet by typing the words.

Anything that asks for a phrase in order to restore, verify, migrate, upgrade or unlock is a theft attempt. There is no exception to this, and no legitimate support process needs the words.

The difference between a real wallet and a fake crypto app is rarely visible on the screen. It is visible in who signed the build, and almost nobody looks at that.

What a fake crypto app does after it is installed

It waits, and then it asks for the one thing that cannot be revoked. The typical sequence is a convincing onboarding flow, a request for the seed phrase framed as an import or a security check, and then either a blank interface or a working-looking interface that shows a balance you cannot move.

A second pattern does not ask for a phrase at all. It presents itself as a trading or rewards app, takes a deposit to an address it controls, and displays a fabricated balance. Withdrawals either fail or require an escalating “fee” that is itself the fraud.

A third pattern is quieter: an app that requests broad permissions — accessibility services, notification access, device administration — which are not needed by a wallet and which extend what the app can observe or do on the device.

Permission requests that should stop an install

The table below maps requests to what they normally indicate. Context matters: some permissions are legitimate for some categories of app, which is why the comparison is against what a wallet needs, not against an absolute list.

A pre-install verification sequence

Run this once per app, and again after any update that changes the publisher name.

1. Close the link you arrived on and open the project’s official site by typing its domain into the address bar.
2. Find the download link published there, and note the exact app name and publisher string it points to.
3. Search the store for that exact name and compare the publisher string character by character against what the official site shows.
4. Read the listing’s recent reviews for reports of lost funds or unexpected phrase prompts, rather than relying on the star average.
5. Check the requested permissions before installing where the platform allows it, and compare them against what a wallet actually needs.
6. Install, then create a fresh wallet or import through the device-side flow only, and never through a web page, a form or a chat.
7. If anything during setup asks for words from an existing phrase, stop, remove the app, and assume the phrase may have been exposed.

Step seven is the one that limits damage. If a phrase was entered, move the funds to a newly generated wallet from a device you trust, because a phrase that has been typed into an unknown app is compromised regardless of what the app claims.