Steve Weisman is a lawyer, college professor, author, and one of the country’s leading experts in cybersecurity, identity theft, and scams. See Steve’s other Con Watch articles.
Malicious software downloaded onto your cell phone can cause many problems, including making you a victim of identity theft, stealing your bank account or other assets, or leaving you more vulnerable to scams. Malware can end up on your phone when you click on infected links or files or when you download a malware-infected app.
To avoid infected links in texts or emails, be suspicious of any link that is sent you. They often appear to come from a trusted source such as UPS or your bank. If you’re concerned that the notice might be legitimate, contact the company via their website (not by clicking on that link!) to inquire about the issue.
As for infected apps, the first rule in avoiding them is to only get your apps from the official stores for Google (Google Play) and Apple (the App Store). These stores do their best to weed out malicious apps, but policing the app stores is a huge job: Google Play has more than three million different apps and Apple’s App Store almost two million.
Apple reported that in 2023, it rejected 1.7 million app submissions; 2022, Google indicated that it banned 173,000 developer accounts from Google Play. However, their efforts are by no means fool-proof. Recently, cloud security company Zscaler disclosed that it had discovered more than 90 malicious apps in the Google Play store that had been installed more than 5.5 million times.
Often the malicious apps such as the Anatsa malware, which allows cybercriminals to access your banking information, are hidden inside innocuous, legitimate-appearing apps such as PDF readers or QR code readers. It’s common for cybercriminals to create multiple developer accounts to upload malicious apps on to Google Play and the App Store so that if Google or Apple bans the developer, the crook can just use a different account. A common strategy is to upload their apps initially without malware, and then once it has passed inspection by Google or Apple, they add the malicious functionality in an update. Security patches and updates are added regularly by legitimate app developers, so a change to the app does not automatically raise suspicion.
Android phones are targeted by scammers more than iPhones, but not because Android phones are less secure. The two primary reasons that scammers target Android phones for their malicious apps is that the Android system is an open system and thus more available to scammers to exploit. Also, more than 70 percent of phones in the world are Android based.
One important way Android users can protect themselves from malicious apps is to use the Google Play Protect option, which is on by default. Google Play Protect does a safety check on apps in the Google Play Store before they are downloaded to your device and will remove harmful apps as well as warn you about questionable apps before they are downloaded.
Along with only getting your apps from the official App Store and Google Play, you should also carefully read reviews of the apps. Even here you need to be a bit skeptical because scammers often will submit phony positive reviews. Also look for the number of downloads a particular app has. This can be an indication of the app’s legitimacy. In addition, during installation consider what permissions the app requests and be skeptical of apps that ask for unnecessary or excessive permissions that appear to be unrelated to the functioning of the app. For instance, a calculator app doesn’t need to have access to your camera, location, contact list, or photos.
Finally, install security software on all of your devices. Most importantly, install updates as soon as they are available.
Become a Saturday Evening Post member and enjoy unlimited access. Subscribe now
