Fake Crypto Apps: How to Spot a Clone Before You Install It

Plenty of Nigerians have scratched the silver panel on a pack of medicine and texted the code to check it's genuine. Nobody calls that paranoid. Fake drugs exist, so you check.

An app that will hold your money deserves the same two minutes. Fake crypto apps copy a real company's name, logo, colours and screenshots, and they work just well enough to take your password or your first deposit. The good news is that most clones give themselves away if you know where to look.

Eight checks before you tap Install

1. Start from the official website, typed in yourself. Not a search advert, not a link in a Telegram group, not a WhatsApp forward. Most companies link to their real store listings from their own site, and that's the safest route in.
2. Check the developer name. On the store listing, the developer (the "seller" on the App Store) should match the company. Tap it and look at the developer's other apps. A finance app whose developer also publishes a torch app, a wallpaper pack and a dating app is unlikely to be the company it claims.
3. Read the app name letter by letter. Clones add words like "Pro", "Official", "Wallet" or a year, or swap a letter for a lookalike. If the name isn't exactly what the company calls its app, stop.
4. Look at downloads against reviews (Google Play). A company with years of history and a large user base shouldn't have an app showing a tiny download count. Be wary, too, of an app with hundreds of reviews but very few downloads. The App Store doesn't show downloads, so look at the number of ratings and how far back the reviews go.
5. Read the reviews, especially the bad ones. Look for "can't withdraw", "asked me to pay a fee", or "this is not the real app". On the other side, a sudden burst of short, identical five-star reviews posted in the same week is a warning, not a recommendation.
6. Check how long the app has been around. The listing's "About this app" or version history shows when it was last updated and often how long it has existed. A company that says it has operated for years shouldn't have an app that appeared last month.
7. Look at what it wants access to. Be careful with a crypto app that asks to read your SMS, use accessibility services or draw over other apps, especially if it didn't come from an official store. Those permissions can be used to read one-time codes and watch what you tap.
8. Check the links on the listing. The website and support email on the store page should point to the company's real domain, the same one you started from.

None of these checks is perfect on its own. Together, they catch most clones.

APK files and "special versions" in your chats

On Android, apps can be installed from files called APKs, outside Google Play. Scammers rely on this. The messages sound like this:

• "The Play Store version is outdated. Download the new version here."
• "This is the VIP version with better rates."
• "Install our app from this link to claim your bonus."

To install an APK, your phone makes you switch on permission to "install unknown apps" for WhatsApp, Telegram or your browser. Treat that screen as a warning sign. A tampered app can record your password, read your codes, or quietly swap crypto addresses when you paste them, a trick we explain in address poisoning and clipboard scams.

Keep Google Play Protect switched on, and if you've ever allowed unknown apps for a chat app, turn that permission back off.

iPhone users aren't immune

Installing apps outside the App Store is harder on an iPhone, so scammers use other routes:

• Test version invitations. A link invites you to install a "beta" of a trading app through Apple's testing system. Real companies do run betas, but you'd hear about them on the company's own website, not from a stranger.
• Profiles. You're asked to install a configuration profile "to enable the app". A profile can give someone else a level of control over your phone. An ordinary finance app from the App Store doesn't need one.
• Websites dressed as apps. You're told to open a link and "add to home screen". It looks like an app icon, but it's just a website, and the address is whatever the scammer chose. Genuine web apps exist too, so the question is always whose address it is.

These tricks show up most in scams where someone you've met online guides you to their favourite trading platform. If that sounds familiar, read our guide to crypto romance scams.

Fake websites work the same way

Clone apps have clone websites: an extra letter, a hyphen, or a different ending to the domain. KWIQ's web version lives at mobile.kwiq.app. Type it yourself or bookmark it rather than following a link from a message. Our guide to using KWIQ in your web browser has a few more tips for staying safe on a laptop or shared computer.

Already installed one?

Don't panic, but do act quickly.

1. Uninstall it. If it refuses, check your phone's settings for any device admin or accessibility permission it was given, switch that off, then uninstall.
2. From a device you trust, change your email password first, then the password and PIN of the real app you thought you were using.
3. Contact the real company through its official website or app, and tell it what happened.
4. Check your bank and crypto accounts. If you entered card or bank details, call your bank.
5. Follow our first-hour checklist for a hacked account if anything has already moved.

How to get the real KWIQ app

The simplest way is to go to kwiq.app and tap a download button, or use the link below. Either way, the link checks your phone and sends Android users to Google Play and iPhone users to the App Store, straight to the official listing. KWIQ has served over 100,000 users since 2017, and if you'd like to know more about the company before you install, read is KWIQ legit?

Once it's installed, remember that KWIQ never asks for your password, PIN or one-time codes, so anyone who does is not KWIQ. Download the KWIQ app through the official link. If your phone is short on space, you can create a free account on the web instead, at an address you can check: mobile.kwiq.app.