How to Identify Suspicious Apps and Links
Quick summary: Warning signs of fake apps, phishing links and scam messages, and what to do if you tapped one.
Scammers depend on speed and curiosity. A message says your parcel is held, your bank account is blocked or you have won a prize, and a link asks you to act now. A fake app promises a free version of something expensive. Both can steal passwords, money or personal data.
You do not need technical skills to stay safe. You need a few checks and the habit of pausing before you tap. This guide explains the warning signs, how to check an app or link, and what to do if you think you have already fallen for something.
Before you start
Settings paths and Play Store menus change between versions and phone brands. Use the search bar in Settings if something is not where we describe it. The advice applies whether the message arrived by SMS, email, WhatsApp or social media.
1. Stop and look at who sent it
Check the sender's number or address. Banks, couriers and government offices rarely start important conversations through a random mobile number or a free email address. A message from a friend can also be a scam if their account was hacked, so ask them in a call if it seems odd.
2. Notice pressure and too-good-to-be-true offers
Scam messages create panic or excitement: act within one hour, your account will be closed, claim your prize. Real organisations give you time and several ways to confirm. Stress is the scammer's best tool, so treat urgency as a warning sign.
Example: A message saying "Your parcel fee of 1.99 is unpaid, pay now to avoid return" with a strange link is a typical delivery scam.
3. Inspect the link before you tap
On many phones you can press and hold a link to see its address. Look at the main domain, which is the part just before the first single slash. Watch for small spelling changes, extra words, odd endings and shortened links. A padlock or HTTPS only shows that the connection is encrypted, and does not prove the site is genuine.
4. Go to the source yourself
Instead of using the link, open the company's official app or type its known website address. If a message claims there is a problem with your account, check your account that way. Use a phone number from your card or the official site, not one in the message.
5. Check an app before installing
In the Play Store, look at the developer name, number of downloads, rating, recent reviews and the Data safety section. Be careful with clones of popular apps that have a slightly different name or a developer you do not know. Fake apps often have few reviews, or reviews that all sound similar.
6. Question the permissions
A calculator, torch or wallpaper app does not need access to your SMS, contacts or call log. If an app wants permissions that do not match its job, deny them or do not install it. Be most careful with apps that ask for Accessibility access or to be a device administrator.
7. Avoid installing from outside the store
Android can install apps from files known as APKs, but you have to give permission in Settings, then Apps, then Special app access, then Install unknown apps. Leave this off for browsers and chat apps unless you know exactly what you are doing. APKs sent in chats are a common way to spread malware.
8. Run Google Play Protect and review installed apps
Open the Play Store, tap your profile picture, then Play Protect, and tap Scan. Then go through Settings, then Apps, and uninstall anything you do not recognise. If an app cannot be uninstalled, you may need to remove device admin rights in Settings, under Security, first.
9. Know what to do if you tapped or installed it
Do not panic. Switch on airplane mode if an unknown app is running, uninstall the app, run Play Protect, and change important passwords from a different, clean device. Turn on two-step verification, and contact your bank at once if you entered card or banking details. Report the scam to your carrier or the cybercrime service in your country.
Pro tip and important warning
Pro tip: Make it a rule: never act on a message that asks for money, codes or logins until you have checked with the real organisation using a number or app that you already trust. It takes two minutes.
Important: Never give out one-time codes, PINs or passwords, never install remote access apps because a caller asks you to, and never trust a message just because it uses your name or a real logo. Criminals can copy logos and sometimes know personal details from leaked data.
Conclusion
Spotting scams is mostly a habit: slow down, check the sender and the link, go to the official app yourself and be strict about permissions. If you do slip, quick action limits the damage. Keep going with Essential Smartphone Security Tips, Useful WhatsApp Privacy Settings, and our Mobile Security & Privacy and Internet & Digital Tips categories.
