Additional resource for the lesson “Fake Ratings: Why the Star Score Tells You Little” — Online Security course
A five-star average with fifty thousand reviews looks like evidence. Fake app reviews are cheap to buy and easy to generate, which means the number you rely on most is the one easiest to manufacture.
A. Why this matters
Ratings and reviews exist to help you choose. They work well enough for popular apps from known developers, and much less well precisely where you need them: for an app you have never heard of, from a developer you cannot place.
Reviews can be bought, generated, or extracted from users by an app that will not function until it is rated. All three are cheap, and all three produce a number that looks like the number a good app would have.
The key idea: treat the rating as one weak signal among several, and read the recent negative reviews instead. That is where the specific, checkable complaints are.
B. Key concepts
Six ideas about the signal and its manipulation.
Rating manipulation
Buying reviews, generating them automatically, or prompting only satisfied users to rate.
Why it matters to you: The last of these is legal and extremely common, which is why an average tells you about the prompting strategy as much as about the app.
Reviews extracted under pressure
An app that blocks a feature until you rate it, or asks repeatedly.
Why it matters to you: This produces genuine accounts giving ratings under mild coercion. Worth noticing when it happens to you.
Patterns worth seeing
Many reviews in a short period, generic praise with no specifics, similar phrasing, reviewers with no other reviews.
Why it matters to you: None of these proves anything alone. Several together are a reasonable basis for looking elsewhere.
Recent negative reviews
Sorted by most recent, filtered to one and two stars.
Why it matters to you: This is the most informative view on the page. Complaints about charges, about a recent update, or about being unable to cancel are specific and checkable.
Developer reputation
What else this developer has published, and for how long.
Why it matters to you: A developer with several apps maintained over years is a different proposition from one with a single app published last month.
Independent sources
Coverage outside the store, from publications or communities you already trust.
Why it matters to you: For anything that will handle money or sensitive data, this is worth the extra two minutes.
C. A practical example: 4.7 stars
An app has 4.7 stars and thirty thousand ratings. It looks well established.
Sorted by most recent, one star
- Eleven reviews this month describing a charge nobody expected.
- Several saying the subscription cannot be cancelled from within the app.
- Two saying the app changed completely after an update.
The average did not move, because thirty thousand ratings absorb a few hundred recent complaints. But the recent complaints are the ones describing what the app is doing now.
This is the practical technique: the average describes the app’s history, the recent negative reviews describe its present.
D. Try it yourself: read one listing properly
Five minutes on an app you are considering, or one you already use.
Step 1 — Ignore the average
- Note it and move on. It is the least informative number on the page.
Step 2 — Sort recent, filter to one and two stars
- Read five.
- You are looking for specific, repeated complaints — not for people who dislike the interface.
Step 3 — Look at the developer
- What else have they published?
- How long have they been publishing?
Step 4 — For anything handling money or data, look outside the store
- A search for the app name plus ‘review’ or ‘problem’ takes a minute.
- Be aware that much app-review content is affiliate-funded.
Step 2 alone changes most decisions. It is faster than reading the description and considerably more informative.
E. Videos, articles and further resources
Independent and institutional sources in English.
FTC — Protect your personal information from hackers and scammers
Consumer guidance on deceptive practices, including manipulated endorsements.
https://consumer.ftc.gov/articles/protect-your-personal-information-hackers-and-scammers
Google — Use Play Protect to keep your apps safe and your data private
What the store does about policy violations, including review manipulation. Platform documentation.
https://support.google.com/android/answer/2812853?hl=en
FTC — Malware: how to protect against, detect and remove it
The signs that something is wrong with a device, and the sequence to follow to clean it.
https://consumer.ftc.gov/articles/malware-how-protect-against-detect-and-remove-it
NCSC (UK) — Cyber security advice for you and your family
The UK national authority’s advice hub for individuals: short, practical guidance written for people who are not IT professionals.
https://www.ncsc.gov.uk/section/advice-guidance/you-your-family
ConnectSafely — Parent and educator guides
Clear guides on social media privacy and digital citizenship, useful if you are also supporting children or students.
https://www.connectsafely.org/guides-2/
CISA — Secure Our World
The US cyber security agency’s public programme: four basic actions, explained for people who are not IT professionals.
https://www.cisa.gov/secure-our-world
Links checked in August 2026. Institutional guidance on this specific topic is thin — it sits between consumer protection and platform policy, and neither covers it fully.
F. The Cyber Welfare Framework: Skills, Awareness, Secure Behavior
This lesson sits on the Awareness pillar at level FL2 and refines the check described in the companion resource.
Skills
- Sorting and filtering reviews to find the informative ones.
- Recognising patterns that suggest manipulation.
- Checking a developer’s history.
For professionals and organizations
- Not relying on store ratings when approving software.
Awareness
- Understanding that the rating is the easiest field to manufacture.
- Recognising prompted reviews as legal and distorting.
- Knowing that recent negative reviews describe the app’s present behaviour.
For future instructors and ambassadors
- Demonstrating the sort-and-filter live. It takes fifteen seconds and changes how people read a store page.
Secure Behavior
- Reading recent reviews rather than the average.
- Checking the developer’s other work.
- Looking outside the store before installing anything handling money.
For organizations
- Maintaining an approved list rather than leaving each person to judge.
G. Questions to sit with
- When you last chose between two apps, what did you base it on?
- Have you ever read the one-star reviews of an app before installing it?
- Has an app ever refused to work until you rated it?
- Would a 4.7 average change your mind if the recent reviews described unexpected charges?
H. What to do now
The recommendations (R) and security measures (MS) that apply.
Choosing
- R17 — Install from official stores, and only what you went looking for.
- MS7 — Check permissions on the listing before installing.
Minimum commitment: Read five recent one-star reviews. It is the highest-value thirty seconds on the page.
After installing
- R6 — Keep it updated.
- MS7 — Review permissions periodically, since an update can change what an app does.
In short
- The average rating is the easiest field to manufacture.
- Prompted reviews are legal, common, and distort the number.
- Recent negative reviews describe what the app is doing now.
- The developer’s history is a better signal than the score.
Related resources in this course
The check and the categories where it matters most:
- Check App Details: The Filter Before You Install
- Avoiding Fleeceware Scams and Apps with Hidden Costs
- Fake Security Apps: When the Protection Is the Problem
Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.
If you would like to follow the whole path, the Cyber Welfare Program is free and open to everyone.
Leave a Reply