How to Check If an Android App Is Safe Before You Install It

Last month, an uncle in our apartment WhatsApp group forwarded a file called “Traffic_Challan.apk”. Two people installed it. One of them lost money from his bank account the same evening.

That’s the sad part – most dangerous apps don’t look dangerous. They look like a bill payment app, a “PDF scanner”, or a free version of something you’d normally pay for. The good news is that a two-minute check catches most of them. Here’s the routine I follow before installing anything.

The Biggest Rule: Be Very Careful With APK Files

An APK is just an Android app file. Apps from the Play Store are APKs too – but they’ve gone through Google’s checks. An APK someone sends you on WhatsApp or Telegram hasn’t.

Scammers love APK files because once installed, a malicious app can sometimes read your SMS (including OTPs), show fake login screens over your banking app, or even control parts of your phone.

Common fake APKs in India include:

• “RTO challan” or “e-Challan” apps
• “Bank KYC update” or “Reward points redemption” apps
• “Electricity bill” apps
• “Wedding invitation” or “photo album” APKs sent by unknown numbers
• “Free premium” versions of Netflix, Spotify or games

If a bank, government office, or company wants you to use their app, they’ll point you to the Play Store, not send an APK file. Treat any APK from WhatsApp, SMS or Telegram as dangerous unless you’re absolutely sure.

Keep “Install unknown apps” switched off

Go to Settings → Apps → Special app access → Install unknown apps (on some phones, search “unknown apps” in Settings). Make sure WhatsApp, Chrome, Files and Telegram are all set to Not allowed. If something ever asks you to turn this on, stop and think.

Before Installing From the Play Store: A Quick Checklist

The Play Store is much safer, but fake and low-quality apps still slip through. Here’s what I check.

1. Look at the developer name

Tap the developer name under the app title. Ask:

• Is it the real company? Your bank’s app should be published by the bank itself.
• Do they have other apps? A brand-new developer with one app that copies a big brand’s logo is a red flag.
• Is there a real website and support email?

Fake apps often have names that look almost right – “SBI Yono Updates” or “WhatsApp Plus Pro”.

2. Check downloads and release date

A popular app from a well-known company usually has a large number of downloads and has been around for years. An app claiming to be a big brand with very few downloads, released last week, is suspicious.

3. Read the reviews – the right way

Don’t just look at the star rating. Ratings can be faked.

• Tap Ratings and reviews and sort by most recent.
• Look for 1-star and 2-star reviews. Are people mentioning “scam”, “fake”, “money deducted”, “full of ads”, “can’t uninstall”?
• Watch for lots of very short, generic 5-star reviews (“Nice app”, “Very good”) posted around the same time. That can be a sign of fake reviews.

4. Read the “Data safety” section

On the app’s Play Store page, scroll to Data safety. Developers declare what data they collect and share, and whether it’s encrypted.

It’s self-reported, so it’s not perfect – but if a simple torch app says it collects your location, contacts and financial info, you’ve learned something.

5. Think about whether permissions make sense

After installing, Android asks for permissions as the app needs them. Ask yourself: does this app actually need this?

• A calculator asking for contacts? No.
• A wallpaper app asking for SMS? Definitely no.
• A photo editor asking for your photos? Fair.
• A maps app asking for location? Fair.

You can always check and change permissions later in Settings → Apps → [app name] → Permissions.

Permissions that deserve extra caution

• SMS – can read OTPs.
• Accessibility – this is a big one. It’s meant for apps that help people with disabilities, but malware abuses it to read your screen and tap buttons on your behalf. Very few apps genuinely need it.
• Display over other apps – can be used to show fake screens on top of real apps.
• Device admin – can make an app hard to uninstall.
• Notification access – can read all your notifications, including OTP messages.

If a random app asks for any of these, decline and uninstall.

Use Google Play Protect

Play Protect is Android’s built-in malware scanner. It checks apps from the Play Store and can also scan apps from other sources.

To check it’s on:

1. Open the Play Store.
2. Tap your profile picture (top right) → Play Protect.
3. Tap the settings icon and make sure Scan apps with Play Protect is on.
4. Tap Scan to check your current apps.

If Play Protect ever warns you about an app – “Harmful app blocked” or similar – please listen to it. Don’t tap “Install anyway”.

Red Flags That Should Make You Stop

• The app is promising something too good: free recharge, guaranteed loan approval, “earn ₹5,000 daily”.
• It asks you to disable Play Protect.
• It wants accessibility access for no clear reason.
• It’s an “instant loan” app from an unknown company asking for access to your contacts and photos. Many such apps have been linked to harassment and data misuse. For loans, use your bank or well-known regulated lenders.
• It pushes you to log in with your bank details inside the app itself when it’s not your bank’s official app.

Already Installed Something Suspicious? Do This

Don’t panic, but act quickly.

1. Turn off mobile data and Wi-Fi to stop it from sending data.
2. Uninstall the app: Settings → Apps → [app] → Uninstall. If uninstall is greyed out, it may have device admin rights. Go to Settings → Security → Device admin apps (search “device admin”), turn it off for that app, then uninstall.
3. Run a Play Protect scan.
4. Change passwords for important accounts (email, banking, UPI apps) – from a different, safe device if possible.
5. Call your bank using the number on the back of your card if you entered any banking details or see unknown transactions.
6. Report fraud at 1930 or cybercrime.gov.in if money is involved.

If the phone still behaves strangely – pop-ups, battery drain, apps you didn’t install – back up your photos and contacts and do a factory reset.

Healthy Habits Going Forward

• Install apps only from the Play Store (or the brand’s official store, like Samsung’s Galaxy Store).
• Update apps and your phone regularly – updates fix security holes.
• Uninstall apps you don’t use. Fewer apps, fewer risks.
• Check app permissions every few months in Settings → Security & privacy → Privacy → Permission manager (path varies by brand).
• Teach family members, especially parents, the APK rule. Honestly, that one rule prevents a lot.

FAQ

Is it safe to install APK files at all?
Only from sources you fully trust, like a developer’s official website. Never install APKs sent by unknown people on WhatsApp or SMS.

Can a Play Store app be harmful?
Yes, sometimes. Google removes many, but checking the developer, reviews and permissions still matters.

What does Play Protect actually do?
It scans apps on your phone for harmful behaviour and can warn you or block installation.

How do I know if my phone has malware?
Signs include unknown apps, constant pop-up ads, unusual battery drain, and OTPs or messages you didn’t request. Run a Play Protect scan and remove suspicious apps.