Log in Request a demo

How To Defend

How To Respond To Fake Mobile Apps.

A fake mobile app alert means someone has published an app that copies your name, icon or look, in an app store or on a download site. Do not install it on a normal phone. Save proof of the listing, then report it to the store and warn your customers where to find the real app.

  • Brand
  • Raised by Digital Risk Protection
Alert area
Brand
Raised by
Digital Risk Protection
First 24 hours
7 steps
Investigation
8 checks
Who acts
SOC analyst, Mobile developer, Malware analyst and 4 more
Last updated October 9, 2026

What This Alert Means.

A fake mobile app alert means an app that looks like yours, or uses your name, logo or icon, has appeared in an app store or on a download site. The alert covers counterfeit applications that pose as your brand.

Attackers copy the look of a trusted app so people install it. MITRE calls this masquerading: the copy borrows the name, icon and package identifier (the internal ID of an app) of a legitimate app. The copy may steal logins, collect card details or carry malware.

Two cases look the same at first. A copycat may be a different publisher using your brand. Or it may be your own app, repackaged with extra code, which is why the file itself needs a careful look.

First 24 Hours.

First save proof, then find out what the app does and who it reaches. Work in parallel where you can.

Do now
  1. SOC analyst Open the alert from the Brandefense digital risk protection module and save the listing address, app name, publisher name, package name, screenshots and the dateThe listing can vanish after a report
  2. Mobile developer Compare the icon, screenshots, description and package name with your real appNote every difference
  3. Malware analyst Download the file only into an isolated test setup and record its hashNever open it on a normal work phone
  4. IT admin Check whether managed phones have it installed and block the package if your device tools allowLog each device found
  5. Customer support lead Prepare a short reply for customers who ask if the app is realPoint to your official app links only
  6. Communications Prepare a notice that names the real app and the real developer accountDo not link to the fake listing
  7. Legal Ask which notices apply to this store and countryCheck with your legal counsel before any formal complaint

Investigation Checklist.

One fake rarely stands alone. These checks show how far it reaches and how to get it removed.

Check the fake app
  • Where is it listed: an official store, a third-party store or a direct download link?This sets the reporting route
  • Does the publisher name copy yours with small changes?List every variant and the developer account link
  • Does the package name or signing certificate differ from your real app?Compare them with the details you keep for your real app
  • What permissions does it ask for, such as SMS, contacts or screen access?Unneeded permissions are a warning sign
  • Does it show a login screen or payment form that sends data to another server?Note every server address it contacts
  • Does it link to a lookalike website or a social account?Add them to the same case
  • How is it promoted: ads, messages, social posts, search results?Each channel can be reported separately
  • Are other fakes listed under the same publisher?Report them together

Containment And Removal.

Most removals start with the store. Keep a log of each report, its date and any reply. If a report stalls, add evidence instead of sending the same form again.

  • Official app store report: use the report or abuse option on the listing, and the store's developer policy channel for impersonation, trademark and malware. Name your brand, link your real app and attach screenshots and the package name. Some stores take brand claims only from the rights holder, so ask your legal counsel who should file.
  • Third-party app stores: look for the abuse or contact page of that store and send the same evidence.
  • Hosting provider abuse contact: if the file is on a download site, ask the host to disable the file and the page.
  • Registrar abuse contact: report the domain of the download site. ICANN says accredited registrars must publish an abuse contact and respond to reports.
  • Ad or social platform: if the app is promoted in ads or posts, report them through that platform's impersonation or ad policy channel.
  • National CERT or law enforcement: in Turkiye, report through USOM (usom.gov.tr). USOM says its cyber reporting services are moving to www.siberguvenlik.gov.tr. In the US, victims of fraud can file with the FBI IC3.
  • Trademark or copyright route: ask your legal counsel whether a formal notice to the store is needed.

  1. Capture the listing and filesave proof first
  2. Report to the storeofficial channel, with evidence
  3. Report the host and registrarfor off-store downloads
  4. Warn customerslink the real app only
  5. Re-check the listinglog the outcome

WarningDo not install the fake app on a phone that holds real accounts, work email or company data. Use a spare test device or hand the file to a malware analyst.

Longer-Term Hardening.

You cannot stop anyone from uploading a copy, but you can make the real app easy to verify and harder to repackage.

  • Publish official app links on one page of your website and link to it from every email, support page and social profile.
  • Link to stores from your own site and avoid sending customers to search for the app by name.
  • Protect app signing and the build pipeline. OWASP warns that attackers can insert code into an app or change it during the build, and advises secure signing and distribution.
  • Use only trusted, validated third-party libraries in your app, as OWASP advises.
  • Keep a record of your real package names, publisher account names and signing certificate details, so reviewers can compare them quickly.
  • Teach customers that you never ask for a login through a link in a message, and that apps come only from official stores. CISA advises checking before sharing information.
  • Keep watching store listings and app download sites for new copies, since a removed fake often returns under a new publisher name.

How To Measure That It Worked.

Use figures from your own log. Do not rely on a general target.

  • Live fakes: the number of fake listings still online each week.
  • Time to removal: days between your report and the listing coming down, per store.
  • Repeat rate: how many removed fakes return under a new publisher.
  • Customer contacts: support tickets or complaints that mention the fake app.
  • Device checks: managed phones that had the fake, and how many are now clean.
  • Official app traffic: visits to your official app links page after the notice.

Common Mistakes.

These errors waste time or put people at risk.

  • Installing the fake to look at it on a normal phone.
  • Reporting before saving proof, then losing the listing details.
  • Assuming it is harmless because it only shows ads. Check what it collects first.
  • Ignoring off-store copies and only reporting the store listing.
  • Linking to the fake in your public warning, which sends it more visitors.
  • Skipping your own app review. If the copy is a repackaged version of your build, check your build process too.
  • Sending legal notices without advice. Check with your legal counsel first.

Questions.

  • How do I report a fake app that uses my company name?

    Use the abuse or report option of the app store where it is listed. Name your brand, link your real app, and attach screenshots and the package name. Stores often handle brand claims through a rights-holder channel, so ask your legal counsel who should file.

  • What if the fake app is not in an official app store?

    Apps on download sites or shared by link are harder to remove. Report the download page to its hosting provider and the domain to the registrar. ICANN says registrars must publish an abuse contact and respond to reports. Also tell customers to install only from official stores.

  • Can I test a suspicious app myself?

    Only on a spare test device that holds no company data and no real accounts. Never install it on a normal work phone. If you lack a safe setup, save the listing, the file and its hashes, and let a malware analyst do the test.

  • How do I tell customers which app is real?

    Publish a page on your website that links to your real app in each official store, and link to that page from your emails, support pages and social profiles. Name the real developer account, so customers can compare it to the listing.

  • Is a copycat app always malware?

    No. Some copies only collect ad money or confuse customers, while others steal logins or card details. Treat every one as a risk until a safe review shows what it does, and report it either way if it uses your name or logo.

Sources

  1. 1 OWASP Mobile Top 10: M2 Inadequate Supply Chain Security
  2. 2 MITRE ATT&CK: Masquerading, Match Legitimate Name or Location (T1655.001)
  3. 3 ICANN: Reporting abuse to registrars
  4. 4 USOM: National Cyber Incident Response Center
  5. 5 FBI IC3: Internet Crime Complaint Center
  6. 6 CISA: Avoiding social engineering and phishing attacks

This page is general security guidance. It is not legal advice. Notification duties and takedown rights depend on your country, your contracts and the facts of the case, so ask your legal counsel before you act on them.

More Playbooks.

All Playbooks
Brand Counterfeit product promotion A counterfeit promotion alert means a post, shop page, listing or ad is selling fake goods under your name. Save proof of the page and the seller first. Then report it to the platform's brand protection channel, check whether the shop is also taking card details, and ask your legal counsel about the next legal steps. Open Brand Fake social media accounts A fake social account alert means someone is using your brand name, logo or staff identity on a social network. Save proof first, then check whether the account is contacting customers or staff. Report it through the platform's impersonation form and warn your own people not to engage with it. Open Brand Fraudulent ads using your brand A fraudulent ad alert means a paid ad uses your brand name, logo or keywords to mislead people. It may point to a fake login page, a counterfeit shop or a malware download. Save the ad and its landing page first without clicking through on a normal device, then report both to the ad platform. Open

Keep Exploring.

Knowledge Hub
Use case Fake Mobile App Detection Find copies of your app in app stores. Open Article What Is Supply Chain Security? Supply chain security protects how software is built, tested and delivered. Learn the key practices, the top five threats and why it matters to… Open Glossary term MITRE ATT&CK MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. Open Technique Masquerading Masquerading is when an attacker changes how a file, program, service or account looks so it seems legitimate. Open

Browse The Library.