How to Spot Fake Crypto Apps - SmartViewAI Blog

Why this works so well

App store review catches a great deal and not everything. Counterfeit wallet and exchange apps appear periodically, sometimes ranking in search results for the real product's name, and they are designed to look identical to the genuine article.

A fake wallet app has one job: capture the seed phrase you enter when you "restore" your wallet. A fake exchange app captures credentials, or shows a balance that does not exist while accepting deposits.

What to check before installing

Install from the developer's own site. Go to the official website, verify the domain, and follow its store link. Do not search the store directly.
Check the developer name, not the app name. Counterfeits copy the app name and icon; the developer account is harder to fake convincingly.
Look at review count and age. A genuine major exchange app has enormous numbers of reviews over years. A few hundred recent ones is decisive.
Read the negative reviews specifically. Victims usually say so plainly.
Check the download count against what you would expect for the platform's actual size.
Look at the update history. Real apps ship updates continuously.

Warning signs after installing

It asks for your seed phrase during setup for anything other than an explicit restore you initiated.
It requests permissions unrelated to its function — SMS access, accessibility services, screen recording.
The interface differs subtly from screenshots on the official site.
Withdrawals require a fee paid upfront, or are blocked pending an extra deposit. This is the defining pattern of fake trading apps.
Support operates only through a messaging app.

The deposit-and-block pattern

A widespread fraud in India works through a fake trading app promoted via messaging groups. Deposits work, the displayed balance rises impressively, and withdrawal attempts trigger a demand for a tax, fee or additional deposit before release.

There is no balance. The displayed figure is a number in an app the operators control. Each additional payment is simply another loss, and the demands continue as long as the victim keeps paying.

If you installed one

Move any funds from wallets whose seed you entered, using a new seed, immediately.
Uninstall, then check for other apps or profiles installed alongside it.
Change passwords for anything accessed on that device.
Report it to the app store and, in India, through the National Cyber Crime Reporting Portal.

See avoiding crypto scams in India for the wider set of frauds that use this distribution method.

Fake browser extensions

The same problem exists outside app stores. Counterfeit wallet extensions appear in browser stores, and because an extension can read every page you visit, a malicious one is arguably more dangerous than a malicious app.

Install extensions only via a link from the developer's official site.
Check the user count — a real wallet extension has millions, not thousands.
Review the permissions requested at install.
Audit installed extensions periodically and remove anything unused.
Be aware that legitimate extensions can be sold and updated maliciously, so periodic review matters even for ones installed safely.

Verifying a genuine app

Positive verification is more reliable than looking for warning signs:

Start at the official website, reached by typing the domain, and follow its store link.
Cross-check the developer name against what the official site states.
Confirm the app's listed website matches the real domain exactly.
For hardware wallets, verify the device is genuine using the manufacturer's own checking tool before initialising.

Counterfeit hardware

A related risk worth naming: counterfeit or tampered hardware wallets sold through third-party marketplaces, sometimes supplied with a pre-generated seed phrase card. Any device arriving with a seed phrase already written down is a theft device — a genuine wallet generates its seed on first use, and never ships with one.

Buy hardware wallets only from the manufacturer or an authorised reseller listed on their site, and initialise the device yourself.

Why app stores cannot solve this

Review processes check for malware signatures and policy breaches at submission. A fake exchange app contains no malware — it is an ordinary app that sends what you type to a server the operators control, which is indistinguishable from legitimate behaviour.

Some counterfeits also pass review in a benign state and enable the malicious behaviour in a later update or via a remote configuration flag. This is why "it was on the official store" is not verification, and why starting from the developer's own website remains the only reliable check.