How to Spot Fake Crypto Apps and Use Them Safely

You’ve picked an exchange or a wallet, and now all that’s missing is the app. This is where scammers strike: they copy apps and download pages of well-known providers, with the same name and logo. Anyone who types their login details or their wallet’s recovery phrase there loses their funds, and no support team will get them back.

Three terms first. An exchange app belongs to a crypto exchange where you have a customer account. A wallet is a digital purse for crypto that you manage yourself, and its recovery phrase is a sequence of words that lets you open the wallet again on any device.

Fake crypto apps show up in app stores and search results

Familiar name, familiar logo, and the app looks real. It can still be fake. The security firm Kaspersky reported 26 fake wallet apps in total in Apple’s App Store on April 20, 2026.

The apps carried the names of well-known wallets such as MetaMask, Ledger, Trust Wallet, or Coinbase, often with small typos, or disguised themselves as games. After launch, they opened a replica of the store page and demanded that you install a developer profile. Through such a profile, a tampered wallet gets onto the iPhone past the App Store.

Most of the finds were in the Chinese App Store. There, according to the analysis by Kaspersky Threat Research, the fakes ranked at the top of the search results. According to Kaspersky, though, the malicious code also works outside China.

In Google’s Play Store, the security firm Cyble found more than 20 such apps in June 2025. They imitated crypto services such as PancakeSwap or SushiSwap and asked for the recovery phrase.

Fake apps can reach you even without a store. Criminals manipulate search engines so that their pages rank at the top. On these pages, visitors are meant to enter login details or download a program, warns Germany’s Federal Office for Information Security (BSI) in its guidance on manipulated search results (page in German).

That is why the safest route to the real app does not start in the search results.

When comparing crypto apps, features and supported cryptocurrencies usually take center stage. For installation, the official website of the selected provider should be used exclusively. Its links to Google Play or the App Store make it easier to find the right listing.

Search for the download and you quickly land on third-party sites

Our Windows Tweaks editorial team checked on October 15, 2026, how quickly a search takes you to a fake site instead. We searched for eight well-known crypto apps the way many people do: the app name plus the word “download”, for example “MetaMask download”.

We looked at every result on the first Google page individually. Does the page belong to the vendor? Is it a guide, a download portal, or a lookalike site posing as the vendor?

What Google shows when you search for the app download

In six of the eight searches, the first results page already included third-party sites offering the download, 11 of the 71 results in total. Eight of them were download portals with apps from many vendors. Three were lookalike sites on Google Sites, a free website builder.

Phantom was the clearest case. Anyone who searched for “phantom wallet download” got a lookalike site as the first result, calling itself “Official Site” in its title. Anyone who clicks there does not land on the vendor’s site.

We also searched the stores for the eight brands. In the German App Store, the genuine app came first for all eight. In Google Play, 19 of the 80 results carried the brand name but came from other companies, such as games sharing Phantom’s name.

We did not find a fake wallet in this store search. So the bigger danger lies before the store, in search results and links. That is why the safe route starts on the provider’s website.

The best way is to type the provider’s address yourself or take it from a comparison you trust. Watch for typos and skip search results that are marked as ads.

On the provider’s website, follow the link to the app. If you don’t find one there, there is probably no official app for your device. In that case, don’t download one under that name either.

Never use links from chats or supposed support messages to install an app. Anyone who pushes you to hurry or guarantees profits is showing typical warning signs of crypto scams.

Many wallets also come as a Windows program or a browser extension. In Microsoft Edge, SmartScreen then warns you if a file isn’t among the known and commonly downloaded files. If that happens, cancel the download instead of clicking the warning away.

Five details in the store listing show whether the app is genuine

In the store, a fake can look just like the original: same name, same logo, good ratings. Five details in the listing show whether it is genuine. We put the checklist together from the help pages of Google and Apple and from warnings by the BSI, Kaspersky, and Cyble.

Test list for Google Play and the Apple App Store

The publisher is the company that puts the app in the store. It is often named differently from the app: Trust Wallet appears in Google Play as “DApps Platform, Inc.” and in the App Store as “DApps Platform Software Services Ltd.” For four of the seven apps that exist in both stores, the name even differs between the stores.

The link to the developer website is more reliable. In all 15 store listings of the eight apps we opened, it led to the provider’s website. So check this link first, and only then the name.

The privacy details are provided by the developers themselves, so they are only an indicator. Downloads and stars also say little, because ratings can be bought, Kaspersky writes. Cyble even found fakes under developer accounts with more than 100,000 downloads, which criminals had probably taken over.

Stop immediately if you see any of these three signs

• After launch, the app opens a page that looks like the App Store and asks you to install a developer profile. Only install such profiles if your employer provides them.
• You’re asked to install an Android installation file (APK) or a profile that doesn’t come from the store, for example via a chat link or an ad. If the provider offers the file itself, download it only from a page you opened yourself.
• A page tells you to turn off protection features. Keep Google Play Protect switched on, the Android protection that checks apps for harmful behavior.

Your wallet’s recovery phrase belongs to you alone

Fake apps and supposed support staff ask for your wallet’s recovery phrase. According to MetaMask, whoever has it controls the wallet and can move your money.

Only a wallet that you manage yourself has a recovery phrase. If an exchange app asks for it, something is wrong. MetaMask support never asks for it and never contacts you on its own via direct message or email.

If you use a Ledger hardware wallet, you enter the phrase only on the device itself, never in an app, according to Ledger.

Kaspersky advises sending only a small amount for the first transfer. In our assessment, that limits the damage but does not prove the app is genuine. A fake wallet can send transfers perfectly normally and still read the phrase you enter during setup.

Limit the app’s permissions and store your recovery phrase offline

If you save your recovery phrase as a screenshot, it ends up in your photo gallery. Then any app with photo access can read it, not just the wallet. So don’t take a screenshot of it, and give each app only the permissions it really needs.

A wallet needs the camera to scan QR codes with receiving addresses. It should only access all your photos if a feature really requires it. The BSI recommends granting only necessary permissions, and you can revoke them at any time in the settings.

The safest place for your recovery phrase is paper, written by hand and stored carefully. MetaMask does not consider cloud storage and password managers safe for this.

On a Windows PC, too, your recovery phrase can end up in the cloud unintentionally. Windows can back up the Desktop, Documents, and Pictures folders to OneDrive automatically. So never save your recovery phrase as a file or screenshot in these folders.

How to limit the damage if you have already entered something

Case A: You entered login details or a confirmation code

With your password and a confirmation code, a stranger can sign in to your account. Open the provider’s website yourself, not through a link, and change your password right away.

Also turn on two-factor authentication, as the BSI recommends. Then every sign-in also needs a code that only you receive. Never share these codes, not even with supposed support staff.

Case B: You entered your recovery phrase

A new password doesn’t help here. Anyone who knows your phrase can open the wallet on their own device and drain your funds.

Create a new wallet with a new phrase right away and send your remaining funds there, as MetaMask describes it. After that, give up the old wallet. Deleting the app is not enough, because access is tied to the phrase.

If you typed or saved the phrase on your PC, check the PC for malware too, as MetaMask advises. To do that, open the “Windows Security” app and start a quick scan under “Virus & threat protection”. More thorough is the “Microsoft Defender Offline scan” in the scan options.

It restarts your PC, so save your open files first. Our separate article explains how to protect your computer from malware and viruses.

Case C: You transferred money

If you paid through your bank, call your bank or payment service provider right away. According to the police, a payment is often not yet fully booked and may still be stopped.

Secure evidence such as chat logs and proof of payment and file a report, online too, through your state police’s online portal (Onlinewache). Crypto you sent from your wallet to someone else’s address, on the other hand, cannot be reversed.

Offers to recover your money for a fee are scams

People who have lost money sometimes get the next offer: someone wants to recover it for a fee. The financial regulator BaFin warned about this scam on October 9, 2026. According to BaFin, nothing is ever paid out, and BaFin itself does not recover any funds.

First the source, then the app

Start every installation on the provider’s website and follow its link to the store. Type your recovery phrase only into a wallet whose origin you have checked yourself, and never tell anyone.

How this guide came about

Our Windows Tweaks editorial team carried out the Google spot check and the comparison of the store listings itself in October 2026. The advice draws on the help pages of Google, Apple, Microsoft, MetaMask and Ledger, as well as guidance from the BSI, the police, consumer advice centers, BaFin, Kaspersky and Cyble.

This guide shows you how to protect yourself from fake apps. It does not recommend any particular app or exchange and is not a substitute for investment, tax or legal advice.

Have you come across a new scam, or spotted a mistake? Write to us via our contact form. We follow up on every tip and update the guide when something changes.