The impact of fake apps describes what can happen to your data and your phone when you install a copy instead of the real app: login details intercepted, permissions misused, a device you can no longer fully trust. The consequences describe what happens to the person: a bank transfer you never made, an awkward phone call to the family, days spent between the bank, technical support and forms to fill in.
A clone app is an application built to look like the app of a service you know — your bank, a delivery company, a public body — with the same logo, almost identical colours and a name that differs by one small detail. It does not exist to give you that service: it exists to get what you would give the original, namely your login details, confirmation codes and permissions on your phone. This post describes what happens next, honestly, without dramatising and without downplaying, and shows why almost everything is decided in the few seconds before you tap install.
It expands on the recommendation on checking an app is genuine before you install it.
A realistic scenario
John retired a few months ago. He looks after the household finances, helps his elderly mother with her paperwork and, for a couple of years now, has been treasurer of his local residents’ association: he collects the membership fees, keeps the list of members and pays the small bills. Almost all of it goes through his phone.
His old smartphone breaks and John buys a new one. That same evening he reinstalls the apps he used to have, one at a time, searching for them by name in the app store. For his bank he types in the name and taps the first result: the logo is right, and so are the colours. He does not check who published it, how long it has existed or how many people have downloaded it. It is rare, but it happens: the stores’ checks stop most imitations, not all of them, and not always straight away.
The app asks for his login details, then for a code sent by text message “to activate your new device”, and finally for a permission called accessibility: a feature designed to help people who find the screen hard to use, but which also lets an app read what appears on screen and act on the user’s behalf. The message says it is needed “for the security of your account”. John agrees. The app shows a waiting screen, and then nothing more.
Two days later the bank rings him: two transfers have gone out to an account he does not recognise. That same afternoon his daughter texts him: “Dad, you sent me a strange message with a link.”
The story would have been almost identical with a fake delivery app, offered by text message to “rearrange a delivery”. From this point on, the consequences spread across five planes.
1. Operational consequences: when your phone is no longer a safe place
A practical example
The bank freezes John’s account and cards as a precaution. He has to uninstall the app, remove the accessibility permission and, on the advice of technical support, reset the phone to its factory settings. The new phone has to be set up again from scratch, and for a few days John cannot pay by card or sign in to his online banking. The association’s fees are left on hold.
Possible effects
- account and cards frozen for days, including for everyday spending;
- a phone to reset and set up again, with every app and sign-in to redo;
- text message codes that cannot be trusted until the device is clean again;
- payments and deadlines on hold, both your own and those of people who rely on you;
- the need for a second device, or for someone’s help, to handle anything urgent.
Why it matters
A clone app with wide permissions does not just compromise one account: it casts doubt on the phone itself, which is usually the very tool you use to confirm payments and sign-ins. Until it is clear what the app has done, the device is not a good place to start again from. The steps to follow, in the right order, are set out in what to do after installing a fake app.
2. Financial consequences: when the damage has a date and an amount
A practical example
Two instant bank transfers, made a few minutes apart, to an account in the name of someone John has never heard of. A few days later he also finds a paid service he never asked for, charged to his phone bill.
Possible effects
- unauthorised transfers and payments;
- money that, once transferred, can be hard or impossible to get back;
- subscriptions or paid services activated without your knowledge;
- indirect costs: replacement cards, technical support, trips to the branch;
- a dispute with the bank that can take weeks.
Why it matters
The rules on unauthorised payments generally offer protection to the people who suffer them, but the outcome is not automatic: it depends on how events unfolded, how quickly they were reported and how the actions of both sides are assessed. Having typed your login details and codes into an app that looked genuine can make the dispute take longer. Reporting it to your bank straight away, using its official number, is the step that counts most.
3. Legal and regulatory consequences: when your phone holds other people’s data
A practical example
John’s phone holds the association’s list of members, with names, phone numbers and addresses, and photos of the documents his mother gave him for an application. The app could read the screen and the messages: nobody knows for certain what it saw.
Possible effects
- the need to assess, together with the association, whether the exposure of members’ data calls for a notification to the relevant authority or to the people affected;
- a report to the police, often requested before a dispute can go ahead and useful to show that you are the victim;
- formal steps and deadlines to handle while you are still in the middle of the recovery;
- requests for an explanation from people who received messages in your name.
Why it matters
When your phone holds data that other people have entrusted to you, an app installed in a hurry stops being a purely private matter. Even a volunteer association handles personal data and has responsibilities for protecting it. This section describes the general picture and is not a substitute for legal advice: if an incident involves other people’s personal data or disputed payments, it is worth speaking to a professional, to your bank or to your organisation’s data protection contact.
4. Reputational consequences: when your number becomes the bait
A practical example
The app also had access to John’s contacts and text messages. Messages go out from his number to his address book, with a link to “see the photos from the association’s party”. Some people open it. Two members ring him, worried; a third does not ring, but from that day on is noticeably cooler with him.
Possible effects
- contacts who receive scam attempts sent from your number;
- members and acquaintances who wonder whether it is wise to keep trusting you with the accounts;
- explanations to send to dozens of people;
- an impression of carelessness, even when the imitation was crafted down to the last detail.
Why it matters
A message from a familiar number gets opened with less caution: that is exactly what makes it work. The person receiving it does not see a scammer, they see John. Trust is rebuilt over time and through openness, and a simple, honest message to your contacts, sent early, is part of the response rather than a detail.
5. Personal consequences: when it weighs on the person
A practical example
John sleeps badly. He feels foolish — he, of all people, who had always warned his mother about suspicious phone calls. For weeks he hesitates before opening any app, and asks his daughter to handle transactions for him.
Possible effects
- shame and guilt, often out of all proportion to what happened;
- prolonged stress and the feeling of not knowing what has been seen;
- a loss of independence: handing over to others things you used to do yourself;
- distrust of digital tools that used to make life easier;
- tension in the family, somewhere between reproach and worry.
Why it matters
This is the least visible consequence and often the most lasting one. It is worth saying clearly: if this has happened to you, it is not because you were naive. Clone apps are built by people who study carefully what makes an app look credible, and they exploit ordinary moments, such as setting up a new phone in the evening. Learning to check is not about feeling guilty over the past: it is about regaining the independence to use your phone with peace of mind.
| Plane | What changes | How long it lasts |
|---|---|---|
| Operational | Account and cards frozen, phone to reset, transactions on hold | Days to a week |
| Financial | Unauthorised transfers, unexpected charges, dispute with the bank | Weeks, not always recoverable |
| Legal | Police report, assessments of other people’s data, possible notifications | Tight deadlines, formal steps |
| Reputational | Contacts deceived from your number, trust to rebuild | Months |
| Personal | Shame, stress, loss of digital independence | Variable, often the longest |
The cost no one budgets for: time
Money can be counted. Time is much harder to count, and it is almost always the heaviest item.
A realistic estimate, based on how these recoveries usually unfold:
| Activity | Indicative time |
|---|---|
| Calling the bank, freezing the account and cards, a first review of transactions | 1–3 hours |
| Uninstalling the app, removing its permissions and, if advised, resetting the phone | 2 hours to a full day |
| Reinstalling apps from verified sources and signing in again | 2–4 hours |
| Changing the passwords of the accounts used on the phone, from another device | 1–3 hours |
| Police report and paperwork for the dispute | Half a day, plus any follow-up |
| Messages to contacts and discussions with the association | 1–3 hours |
| Checks on accounts and charges over the following weeks | Ongoing |
These are hours nobody planned for, packed into days when you are already under pressure and often without your own phone to hand.
The comparison speaks for itself: checking that an app is genuine takes less than a minute per app.
The consequences that fall on other people
The consequences of a clone app rarely stop with the person who installed it.
- Family members receive convincing messages in your name, and are the first people you turn to for help during the recovery.
- Fellow members or colleagues see data they entrusted to you exposed, and receive scam attempts from your number.
- The people whose paperwork you handle, like John’s mother, find their documents exposed without having done anything.
- Anyone who opens the link you appeared to send risks repeating the same story on their own phone.
This is why, in the Cyber Welfare Framework, personal security is not treated as a purely private matter: every app you check also protects the people in your address book and in your documents.
How this ties back to the recommendation
All of these consequences start from the same place: an app installed without checking who published it.
Not an old phone, not a lack of skills. A search by name and the first result tapped in a hurry, during an ordinary routine.
Recommendation R25 asks you to interrupt exactly that automatic gesture: start from the service’s official website and follow its link to the app store, then check the developer, the exact name, and the app’s history and number of downloads. Downloading only from official app stores is the first filter, and it will be the subject of a dedicated recommendation. Checking that the app is the real one is the second filter, and it is the one missing from the scenario. The ways app stores check apps are a valuable help, not an absolute guarantee; to understand how imitations are put together, see the post on cloned and counterfeit apps.
How to reduce the risk
- Start from the service’s official website, or from the instructions you were given at the branch, and use its link to reach the app in the store instead of searching by name.
- Check the developer: it should match the name of the service, not a variation or an unrelated name.
- Look at the exact name, the publication date and the number of downloads: the app of a bank or a national delivery company usually has years of history and a very wide user base.
- Weigh up the permissions it asks for: a banking app has no reason to request accessibility “for security”. For guidance, see checking what your apps can do.
- Do not install apps from links received by text message, email or chat, even if they seem to come from a delivery company: open the store or the official website yourself.
- Keep your bank’s official number to hand, on paper or somewhere other than your phone, so that you can call straight away.
- If something does not add up after installing, the signs of a fake app help you judge whether you need to act.
Quick checklist
- ☐ When I install my bank’s app or another important service, I start from the official website
- ☐ Before installing, I check the developer’s name
- ☐ I look at the publication date and number of downloads of any app that asks for login details
- ☐ I do not grant accessibility to apps with no obvious reason to ask for it
- ☐ I do not install apps from links received by text message, email or chat
- ☐ I have my bank’s official number written down somewhere other than my phone
How this connects to the Cyber Welfare Framework
| Pillar | What this content contributes |
|---|---|
| Awareness | Connecting a quick gesture, like tapping the first result in the store, to concrete effects on money, data and relationships |
| Skills | Telling the five planes of consequence apart and knowing which checks to make before installing |
| Secure Behaviour | Checking every app that asks for login details or payments, and reporting to the bank straight away if something does not add up |
Reference level: FL2 — Beginner. This is the level at which a check that takes a few seconds stops feeling like a formality and becomes a choice with a clear reason behind it.
Conclusion
A clone app does not produce “a cyber risk.” It produces a frozen account, money that may not come back, explanations owed to family and acquaintances, and a stretch of time spent using your phone with unease.
The good news is that most of these consequences can be avoided with one habit that is within anyone’s reach: before installing an app that asks for login details or payments, check who published it and reach it from the official website. If you would like to know where to start, the digital resilience self-assessment helps you see, in a few minutes, the areas worth working on.
Something to think about. If you had to reinstall your bank’s app on a new phone tomorrow, where would you start — and what would you look at before tapping “Install”?
Related resources
Short explainers from the Resources section, for anyone who wants to focus on a single aspect:
- Check App Details: The Filter Before You Install
- Fake App Reviews: Why the Rating Tells You Little
- Download Security: Deciding Before You Install
Related content
- Checking an app is genuine — the recommendation this belongs to
- Impact of fake apps — the technical plane: confidentiality, integrity, availability
- What to do after installing a fake app — the steps in order, from uninstalling to reporting
- Signs of a fake app — what to look for before and after installing
- Cloned and counterfeit apps — how imitations are built and why they work
Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.
