How Fake Apps Steal Personal Information

Google removed over 1.5 million policy-violating apps from the Play Store in 2022, yet a subsequent wave of look‑alike counterfeit apps racked up more than 20 million installs before detection. The culprits included currency converters that silently hoovered contact lists, photo editors that scraped SMS one‑time codes, and fitness trackers that sold real‑time location data to ad‑fraud networks. The root cause isn’t a single exploit — it’s the widespread belief that Android’s default safety net catches everything. It doesn’t.

Malicious apps thrive because most users keep the OS in its out‑of‑the‑box state, granting permissions without a second thought and ignoring the fine print in installation dialogues. This article walks through the settings you need to revisit today, why they matter, and where an extra layer of oversight can fill the gaps.

Why Default Android Settings Are Not Enough

Android ships with a permission model that is theoretically granular but practically porous. The “install from unknown sources” toggle has been decentralised since Android 8 Oreo — each app (file manager, browser, messaging client) can request its own exemption. A single tap on “Allow” during a rushed moment, and the door stays open for future sideloads without further prompts. Default Play Protect scans are useful but reactive; a phishing campaign distributing a fake banking app via SMS link can achieve thousands of infections before its signature is blocked.

Even legitimate‑looking apps from the Play Store can turn hostile after an update if they slip past heuristic checks. The alarm bells ring late because Android’s built‑in logs don’t surface historical permission changes or app‑installation provenance in a single view. There’s no default mechanism that tells you, at a glance, that Calculator XYZ quietly gained SMS access three days after installation. Without intentional hardening, you’re trusting that every “Allow” button was pressed with full context.

Permission Audit — How to Review What Apps Can Access

Start with a manual sweep. Head to Settings > Privacy > Permission manager (the exact naming varies slightly between manufacturers, but the path is consistent on Pixel, Samsung, and OnePlus devices running Android 12 and above). You’ll see a list of high‑risk permissions — Camera, Location, Microphone, SMS, Contacts, Call logs, Physical activity — each showing the count of apps with access.

Tap each permission and scrutinise the list. Does a note‑taking app really need Contacts? Why would a solitaire game require Reading SMS? Revoke access immediately for anything that lacks a plausible justification. Tap “See all apps with this permission” to catch apps that have access but are flagged under “Allowed only while in use” — a setting that can still leak data if the app maintains a persistent background service.

Beyond the basic permission manager, check two often‑overlooked categories: Usage access (Settings > Apps > Special app access > Usage access) and Display over other apps. Malware frequently abuses overlay permissions to draw fake login screens on top of banking apps, capturing credentials. A spoofed messaging app granted “display over other apps” can intercept 2FA codes that appear as heads‑up notifications.

If you manage a family device, the timeline of permission changes matters. Spapp Monitoring logs when any monitored app requests or is granted new permissions, creating a forensic trail that the stock Android permission manager doesn’t offer. A parent can see, for example, that a child’s new “wallpaper” app requested SMS access at 2 a.m. — a red flag no built‑in audit would highlight.

Critical Security Settings — Step‑by‑Step for Each Setting

Disable “Install unknown apps” for Every App

Navigate to Settings > Apps > Special app access > Install unknown apps. You’ll see a list of applications that can trigger sideloading. By default, browsers and file managers often have this permission enabled. Switch each one to “Not allowed.” If you need to sideload a single, verified APK, enable it only for the specific session and then revoke it immediately afterward. This setting is the single most effective control against drive‑by downloads of fake app installers.

Turn On Play Protect’s Full Scanning

Open the Play Store, tap your profile icon, then “Play Protect.” Enable both “Scan apps with Play Protect” and “Improve harmful app detection.” The second toggle sends unknown apps to Google for real‑time analysis, catching zero‑day threats faster than offline scans. Re‑scan your device manually every month.

Restrict Lock Screen Notifications

Go to Settings > Notifications > Notifications on lock screen and choose “Hide sensitive content” or “Don’t show notifications at all.” A fake app that gains accessibility access can read notification content; if it can’t see SMS codes or password reset links on the lock screen, the data is less useful. This also prevents shoulder‑surfing attacks in public.

Review Device Administrator and Accessibility Services

Settings > Security > Device admin apps. Remove anything that isn’t Find My Device or a trusted enterprise policy. Then go to Settings > Accessibility > Installed apps. Malware often prompts users to enable an accessibility service to read screen content and simulate taps. Only apps you explicitly use for accessibility (like TalkBack) should be here. If you spot an unfamiliar service named “System Update” or “Cleaner,” disable it immediately.

Enable Two‑Factor Authentication on Your Google Account

Because a fake app that captures your Google account token can bypass many device‑level defences, turn on 2FA via Settings > Google > Manage your Google Account > Security > 2‑Step Verification. Use a hardware security key or an authenticator app rather than SMS where possible, since SMS codes can be intercepted by malware with SMS permissions.

Restrict Background Data for Unused Apps

Under Settings > Network & internet > Data usage > App data usage, tap rarely‑used apps and toggle “Background data” off. This chokes a fake app’s ability to phone home with stolen contacts or location data, even if it gained network permission during installation.

Set Up Find My Device

Not just for lost phones — a device that suddenly shows up in unfamiliar locations in your Find My Device timeline can indicate remote access or a SIM‑swap attempt. Enable it at Settings > Security > Find My Device.

Where Monitoring Apps Fit In — Spapp as a Layer of Oversight

Even after locking down every toggle, a determined user on a shared family device can still be tricked into installing a fake app via a cleverly disguised phishing page. The NSPCC stresses that technical tools work best when paired with ongoing conversations about digital safety, but those tools need to provide visibility that Android’s built‑in menus don’t surface.

Spapp Monitoring adds that layer by periodically cataloguing every installed application — including package names, install sources, and version details — and flagging entries that originate from unknown sources. A cloned WhatsApp with a slightly altered package name (com.whatsapp versus com.whatsapp.clone) is immediately obvious in the app inventory, whereas the standard app drawer shows only an identical icon.

The tool also logs SMS messages and call details, which can reveal if a fake banking app has triggered verification texts at odd hours. Combined with location history, a parent might notice that a device is pinging from a tower near a known phishing hotspot, correlating physical presence with suspicious app activity. The data stays on a dashboard that can be checked weekly, eliminating the need to manually comb through four different Android settings panes.

One critical caveat: installing monitoring software on another adult’s phone without explicit consent violates wiretapping laws in multiple jurisdictions, including the UK’s Computer Misuse Act and the US federal Wiretap Act. Spapp Monitoring is designed as a parental oversight tool and must be used only on devices you own or where you have legal guardianship with informed disclosure, following the NSPCC’s guidance on transparency with children.

What to Check Monthly — Ongoing Maintenance List

1. Full app list sweep. Settings > Apps > See all apps, sort by “Last used.” Uninstall anything you don’t recognise and haven’t opened in the past 30 days — especially apps with generic names like “System Service” or “Settings Manager.”
2. Data usage anomalies. Settings > Network & internet > Data usage > App data usage. Look for an app that consumed 200 MB in the background yet you never actively used it. This often points to data exfiltration.
3. Permission re‑audit. Re‑run the permission manager review. Apps can gain new permissions after updates without explicit re‑prompting if they target older API levels, still surprisingly common on budget devices.
4. Battery drain check. Settings > Battery > Battery usage. Fake apps frequently run hidden processes that cause disproportionate drain. If a flashlight app shows 15 % battery usage, something is wrong.
5. Accessibility and device admin re‑inspection. Check both menus again; new entries rarely appear, but when they do, it’s often tied to a malicious install.
6. Play Protect full re‑scan. Trigger a manual scan from the Play Store.

Spapp Monitoring automates parts of this checklist with scheduled reports. Its monthly digest highlights apps that suddenly spiked in background data or location requests, making it possible to spot a rogue app that otherwise blends into a teenager’s cluttered app drawer.

Common Mistakes to Avoid

Mistake 1: Granting SMS permission to every app that asks. Some banking trojans require SMS access to intercept OTPs. If an app doesn’t need to read or send texts for its core function — think photo editor, game, QR scanner — deny it, even if it means losing a “feature” like automatic verification code filling.

Mistake 2: Leaving “Install unknown apps” enabled for the file manager. One‑time sideloads often turn into permanent open doors. After installing a verified APK, immediately disable the permission for the app you used.

Mistake 3: Thinking Play Protect alone is sufficient. A Check Point Research report from Q3 2023 documented fake cryptocurrency apps that stayed on the Play Store for over two weeks before detection, amassing thousands of installs. Play Protect is a safety net, not a firewall.

Mistake 4: Using the same Google account for sensitive services on a device that frequently sideloads. A fake app that manages to steal a Google auth token can compromise email, Drive, and Photos. Use a separate, less‑privileged account for devices where sideloading is routine, or better, don’t sideload at all on primary phones.

Mistake 5: Ignoring the “Display over other apps” permission. This enables overlay attacks — a threat vector so potent that Google itself restricted the permission in Android 10 and later, but users can still manually grant it. Review which apps have this permission under Settings > Apps > Special app access > Display over other apps.