What an app store is for
An app store does more than host downloads. It gives developers a way to distribute software, gives users a single place to find it and, importantly, gives the platform owner a point where apps can be checked before they reach millions of phones. The store also handles payments, updates and, in many cases, the removal of apps found to be harmful.
That checking is real and does remove a lot of bad software. It is also limited, and understanding both sides helps you decide how much to rely on it.
How apps are typically vetted
The details are not fully public and they change over time, but review generally combines several layers.
Automated scanning. Submitted apps are usually analysed by software that looks for known malicious code, suspicious behaviours, and use of restricted features. Some stores also run the app in a controlled environment to watch what it does.
Human review. Some or all submissions are looked at by people, who check whether the app does what it claims, follows content and payment rules and asks for permissions that make sense. The depth of this review varies between stores and between kinds of app.
Developer requirements. Developers generally must register an account, accept policy terms and sometimes verify their identity. This does not stop dishonest people, but it raises the cost of anonymous abuse and gives the store someone to ban.
Technical controls on the phone. Apps are signed so that tampering can be detected, and each runs in a sandbox with limited access to other apps’ data. Features that matter, such as the camera or location, need your permission. What those app permissions really allow is worth knowing in its own right.
After release. Stores monitor reports and behaviour, and can remove an app from the listing. On many phones the operating system can also disable an app that has already been installed, though this depends on the platform and the case.
Why some harmful apps still get through
Review can narrow the odds but it cannot guarantee safety, for a few reasons.
- Scale. Stores receive an enormous number of apps and updates. Reviewers and tools have limited time for each.
- Apps can behave well during review. A developer can submit something harmless, and later change what it does. Code that is hidden, delayed, switched on remotely or only active in certain regions or conditions may not be seen during testing.
- Updates. An app that was fine at first can be sold or updated to include advertising, tracking or worse. The same pattern appears with browser extensions.
- Legitimate features used badly. Some harm does not involve malware at all. An app can be honestly described yet collect more data than people expect, use pushy subscriptions, or contain misleading in-game purchases. These are policy questions, not simple detection problems.
- Impersonation. Fake apps copying the name and icon of a trusted service sometimes appear, and the real service may not be quick to notice.
- Scams that live outside the app. An app that is technically harmless may be a front for a fraud, for instance a fake investment or “loan” app that pressures people to pay. Many phishing scams now lead to an app listing, not only to a website.
Stores usually respond by removing apps once they are found. Between release and removal, though, people can be affected, which is why occasional news of a harmful app appearing in an official store is not surprising, and does not mean the system is useless.
Sideloading
Sideloading means installing an app from somewhere other than the platform’s official store, for example by downloading a file from a website or using an alternative store. Rules differ by platform and, increasingly, by region and by law, so check what applies to your phone.
Reasons people do it include getting apps that the store does not allow, installing older versions, using software from small developers or testing their own work. The risk is that the store’s checks are no longer in the path. Files from unknown sources may have been modified, and nothing guarantees that updates will be honest or even arrive. Some malware spreads precisely by persuading people to turn on installation from unknown sources, often with a pretext such as a free version of a paid app.
Where sideloading is allowed, phones usually ask for a specific permission before it can be used. Treat that prompt as a meaningful decision. If you do install from outside a store, prefer the developer’s own official site, avoid cracked or “free premium” versions of paid apps, and consider switching the permission back off afterwards.
Habits that lower your risk
- Use the official store and check the developer’s name, not just the app title. Look at the number of downloads, the age of the listing and the contents of lower-rated reviews.
- Be sceptical of apps promising money, prizes or unlocking something paid.
- Ask whether the permissions fit. A flashlight app that wants contacts or location is a mismatch.
- Install fewer apps. Each one is another piece of software and another company holding some of your data. Remove ones you no longer use.
- Keep software updates switched on, both for the operating system and apps, since fixes depend on them. Our article on why software updates matter explains the reasoning.
- Read the privacy policy summary where the store shows one, including what data the app says it collects, bearing in mind it is a statement by the developer.
- Watch for sudden changes such as new ads, unexpected requests for permissions or battery drain after an update.
If an app seems to have misbehaved, uninstall it, change passwords for any accounts you used with it and contact your bank if payment details may have been involved. Reporting the app through the store helps others.
A fair summary
Store vetting is a valuable filter, and for most people the official store is the safest place to find apps. It is not a certificate of safety. The most reliable protection is a combination of the store’s checks, the phone’s permission system, your own choices about what to install, and keeping everything up to date.