One of the quietest ways people lose crypto is by downloading a fake version of a real app. It looks identical, has the right logo, and even shows up in app stores or ads — but it exists only to steal your login or seed phrase. Here's how to catch one before it catches you.
Why fake apps are so effective
A fake app doesn't need to "hack" anything. You hand it your credentials yourself, because you believe it's the real thing. By the time you notice, the funds are gone. The whole con relies on you not pausing to verify.
So the defense is simple in principle: verify before you install, and never enter secrets into something you haven't verified.
The warning signs to check
1. Reach the app through the official website — not an ad or a search result. Scammers buy ads and game search rankings. Go to the exchange or wallet's official site (type the address yourself), and use the download link there. That single habit defeats most fake-app attacks.
2. Inspect the developer name. In the app store, check who publishes the app. Fakes often use a slightly-off developer name, a brand-new account, or a generic publisher. The real company's apps are published under its verified developer profile.
3. Look at the review history, not just the rating. A real, popular app has a long history of many reviews. Red flags: very few reviews, a flood of identical 5-star reviews posted in a short window, or recent reviews complaining about stolen funds.
4. Check the download count and age. A major exchange app has millions of downloads and years of history. A "Binance" or "Coinbase" clone with 2,000 downloads and a release date of last week is fake.
5. Be suspicious of permissions and prompts. No legitimate app needs your seed phrase to "verify," "sync," or "validate" your wallet. If an app asks you to type your recovery phrase to import or activate, stop immediately — that request alone marks it as malicious.
6. Watch for urgency and "limited" prompts. Fakes often push you to act fast — "claim now," "verify before lockout." Urgency is a manipulation tactic. Real apps don't threaten you into entering secrets.
If you think you installed a fake one
- Don't enter any credentials or seed phrase.
- Delete the app.
- If you already entered a seed phrase, assume the wallet is compromised and move any funds to a brand-new wallet (created on a trusted device) immediately.
- If you entered an exchange password, change it and enable app-based 2FA right away.
The core habit
Almost every fake-app loss traces back to skipping verification. Reach apps through official sites, check the developer and review history, and never type your seed phrase into anything that asks. A two-minute check is cheaper than losing everything.
For more on staying safe, see our full Bitcoin security guide, and our breakdown of common crypto scams.