Ilia Nikolaevich Zavialov on app reviews: how to spot a fake banking app and an inflated rating

Before installing an app almost everyone looks at two things: the rating and the first reviews. If there are plenty of stars and the reviews praise convenience, the app gets installed without a second thought. Fraudsters know this and work on exactly those two signals.

A fake banking or investment app looks almost like the real thing: a familiar logo, the brand colors, a similar name. The reviews under it are written by bots or bought accounts, and the rating stays at a level that raises no questions.

Ilia Nikolaevich Zavialov explains how fake apps are built, why they turn up even in official app stores, how to read reviews and ratings so that a fake becomes visible, and what to do if one is already installed.

A fake starts with the name. It repeats the bank's name with a small addition: online, mobile, wallet, assistant. The icon copies the brand mark, and the screenshots on the store page are taken from the real bank.

The main difference is in the developer line. For a genuine app the developer is the bank itself or its official company. For a fake it is an unfamiliar name, a private individual or a company with no link to the bank.

The second difference is history. A genuine banking app has existed for years, with millions of installs and tens of thousands of reviews spread over time. A fake appeared recently, and its reviews were written within a few days.

Inside, a fake can look convincing. The login screen asks for a username, password and text code, sometimes the card number and CVV. Everything entered goes to the fraudsters, who log into the real bank at once.

App stores fight fake ratings on a huge scale. Apple reported that in 2025 it blocked close to 195 million fraudulent ratings and reviews before they ever appeared on the App Store. Google blocked 160 million spam ratings and reviews on Google Play in the same year, including inflated and deflated ones.

Those numbers show the scale and also that some fake reviews get through the filters. Short enthusiastic reviews without detail, identical in structure and posted on the same days, are a sign of manipulation.

Manipulation can also work in reverse. Competitors or fraudsters flood a genuine app with bad ratings so that people look for an alternative and find the fake. A sudden drop in rating for a long established app is also worth checking on the bank's official website.

One star reviews are the most useful to read. That is where users write that the app turned out to be fake, that money disappeared after logging in or that the developer has nothing to do with the bank. If such reviews exist and are recent, do not install the app.

One of the craftiest schemes gets around store review. The app passes moderation as a harmless puzzle, calculator or notes tool, and some time later its content changes and turns into a fake bank or investment platform.

Apple reported that in 2025 it removed nearly 59,000 apps that switched their functions after review to commit financial fraud, and terminated 193,000 developer accounts. That shows the scale: the switch has become an established technique.

The switch usually happens after the app has gathered its first installs and reviews. So even a familiar app that suddenly starts asking for bank card details or a bank login should be removed and checked.

For the user the conclusion is simple. An app from an official store does not become a bank by using its logo. What gets checked is the developer and the route by which you reached the app.

The second large group of fake apps never lives in stores. The link arrives in a text, in a messaging app or during a call supposedly from the bank: the old app no longer works, install the new one from this link.

On Android such a link leads to an installation file that bypasses the store and receives broad permissions. Google reported that in 2025 its protection blocked 266 million risky installation attempts outside Google Play. On iPhone the link more often leads to a phishing page that looks like a bank login.

Sometimes the link promises an updated version with new features or a special version for receiving a payment. Promising something that the official app does not have is itself a sign of a fake.

A real bank does not send app installation links through messaging apps and does not ask you to install anything during a call. If the app needs reinstalling, the route to it is on the bank's official website, opened by hand.

A fake app almost always asks for more than a bank needs. Access to text messages to read verification codes. Accessibility services to tap buttons on the user's behalf. Display over other apps to replace the screen of the real bank.

A genuine banking app requests permissions too, but the set is understandable: notifications, the camera for scanning documents, sometimes location. A request for accessibility services from a banking app is a warning sign.

Remote access tools work in a similar way. A caller posing as the bank asks you to install an app to protect or check the account and in fact gains the ability to see the screen and control the phone while the person opens the real bank.

If an app insists on a permission and refuses to work without it, that is another sign. Remove the app and check which other programs have similar access.

A separate category of fakes is trading and investment apps. They are advertised on social media and in chats, sometimes posing as a known broker, sometimes as a new platform powered by artificial intelligence. Inside there are attractive charts, a balance and a trading history.

The balance in such an app is a number on the organisers' server. It grows while the person tops up the account and stops meaning anything the moment they try to withdraw: a withdrawal tax, a fee or a frozen account appears.

Reviews under these apps are especially enthusiastic because the organisers write them. The check is the same as for a bank: developer, regulator's license, recent negative reviews. A broker's license is checked in the regulator's register in your country, and the app's name alone will not tell you.

Banks are one of many brands copied this way. Fake apps of government services, delivery companies, mobile networks and marketplaces follow the same logic: a familiar name and logo, and inside a form that collects card details or codes.

Such an app often comes with a story about a payment, a fine or a parcel. To receive help, pay for delivery or check a debt, you need to install the app from a link. Genuine government services and delivery companies do not work this way.

The rule is the same for every category. Apps are installed from the official store through a link on the organization's official website, and the developer name is checked in the store. Any app you are invited to install from a link in a message should be treated as fake until checked.

Start with the developer line and compare it with the bank's official website. Then look at the number of installs and the date of the first version. A banking app with a couple of thousand installs, released a month ago, is almost certainly fake.

Sort reviews by date and read the recent negative ones. If they mention a fake, missing money or strange permission requests, that is enough to decline the installation.

Look at the developer's replies. A real bank replies to reviews as its support service and refers to its official contacts. A fake either stays silent or replies with template thanks.

Finally, the route to the app. The safest way is to go to the store through a link on the bank's official website. In a search by name, fakes sit right next to the original.

Fake investment apps have a documented history in the United States. In 2022 the FBI identified 244 victims of fake cryptocurrency investment apps with losses of about 42.7 million dollars, and one of those apps used the name and logo of a real American bank.

The wider numbers explain why the scheme persists. The Federal Trade Commission recorded more than 7.9 billion dollars in reported losses to investment scams in 2025, with a median individual loss of more than 10,000 dollars.

Social media is where many of these journeys begin. In 2025 almost 30 percent of people who reported losing money to fraud told the FTC it started on social media, with 2.1 billion dollars lost in total.

Someone in Dallas, Phoenix, Atlanta or Denver deciding between two apps with similar names should check the developer line first and the stars last.

If you entered a username, password, code or card details into a suspicious app, call your bank at once on the number on the card and block the card and online banking access. Speed decides everything here.

Remove the app and check the list of installed programs and granted permissions. If the app had accessibility or text message access, have the device checked with security software or by a repair service.

If the app had access to text messages, the fraudster may have seen verification codes the whole time it was installed. Ask the bank to review recent transactions and logins for that period.

Change the passwords for online banking and email from another device and switch on extra login verification. Keep the app's name, the developer's name and screenshots: the bank and the police will need them.

If money has already gone, call the bank at once on the number on the card and report the fraud to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov. Include the app's name, the developer and where you downloaded it.

Report the fake app to the store through the report button on the app's page. Such reports help remove the fake faster.

Make it a rule to install a banking app only through the link on the bank's official website, never from a link in a message or a call.

Can fake apps appear in official app stores?

Yes. Stores remove them by the million, but some pass review or switch content after moderation. Check the developer name and the route to the app.

Can I trust a high app rating?

Not always. Ratings are manipulated, so recent one star reviews, the number of installs and the date of the first version tell you more.

Which permissions should raise concern?

Access to text messages, accessibility services and display over other apps. A banking app usually needs none of these.

The bank sent me a link to a new app. Should I install it?

No. Banks do not send installation links through messaging apps or ask you to install apps during a call. Go to the store through the bank's official website.

What if I entered my details into a fake app?

Call the bank at once on the number on the card, block the card and online banking, remove the app and report to ReportFraud.ftc.gov and ic3.gov.