File source is the first security property
An Android package can be copied, renamed and redistributed. The file name and icon do not prove who built it. Prefer a recognised app store or a destination you reached independently. A file received through a personal message, pop-up, shortened link or “support” chat has a weaker chain of trust.
Before installation, write down where the file came from, the exact domain, file name, download time and any warning shown. If the source later changes its story, those details help explain what happened.
Keep Android protection active
Google Play Protect scans apps and may check files installed outside Google Play. Google’s Android help explains that unknown apps can be sent for additional detection and that harmful apps may be warned about, disabled or removed. Review the current instructions in Google Play Protect help.
Do not turn off protection just because an installer tells you to do so. A warning may occasionally need investigation, but the correct response is to verify the app identity and source—not to disable every safeguard.
Permission risk depends on capability, not wording
| Permission or capability | What it can affect | Question to ask |
|---|---|---|
| Accessibility service | May read screen content or perform actions on the user’s behalf. | Does this game have a genuine accessibility function that explains the need? |
| Display over other apps | Can place content above banking, OTP or login screens. | Will the app work without overlay access? |
| SMS or notification access | May expose OTPs and transaction messages. | Is the feature essential, visible and limited? |
| Contacts and call logs | Can reveal personal networks and communication history. | What game function requires this information? |
| Device administrator | Can make removal harder and control device policies. | Why would a game need administrator-level control? |
| Camera or microphone | May capture sensitive surroundings or identity material. | Can access be allowed only while using a specific feature? |
Practical file-identity checks
A package name, digital signature and cryptographic hash can help distinguish one APK from another, but these checks are useful only when there is a trusted value for comparison. A hash supplied by the same unknown sender does not independently validate the file.
On supported devices or security tools, record the package name, version, signer information and SHA-256 hash before removal. Compare them with a value published through a source you reached independently. A different signer during an update may indicate a separate build, repackaged file or changed distribution chain.
Do not upload a private or paid app package to random scanning websites without considering confidentiality and licence terms. Play Protect and a reputable local security product can provide an initial check without publicly distributing the file.
Post-install observation window
The first few minutes after installation are useful. Keep sensitive apps closed and watch for permission prompts, overlays, browser launches, background downloads, notification access requests and attempts to change security settings. Review data and battery use again after a normal period of inactivity.
- The app should not open banking or accessibility settings without a clear user action.
- A game should not need to become the default SMS or phone app.
- Unexpected device-admin activation should be refused.
- Persistent pop-ups outside the app are a reason to remove and scan.
- A sudden request to install a second “security” or “update” package deserves independent verification.
A safer installation sequence
- Update Android and the browser or file manager used for download.
- Confirm available storage and device date/time.
- Scan the device with Play Protect before opening the package.
- Review the install screen for the app name and source.
- Decline unrelated permissions during first launch.
- Open the app without banking or payment apps visible in the recent-apps screen.
- Check battery, data, notification and background behaviour after installation.
- Disable the temporary unknown-app installation permission.
Behaviour that deserves immediate review
Unexplained overlays, disappearing security settings, a battery spike, persistent background data, notification-reading requests, inability to uninstall, pop-ups outside the app, or forced screen-sharing are not normal inconveniences. They may indicate aggressive or malicious behaviour.
If the app had access to SMS, notifications, accessibility or overlays while you used banking or email, use a clean device to change important passwords. Contact the bank if payment approval may have been exposed.
Clean removal without losing evidence
- Capture the app name, version, permissions and install source.
- Turn off accessibility, overlay and device-admin access before uninstalling.
- Uninstall the app and restart the phone.
- Run Play Protect and update remaining apps.
- Review installed apps for anything added at the same time.
- Change sensitive credentials from a trusted device when exposure is possible.
- Keep screenshots and the file hash if a bank or authority may need them.
CERT-In’s public material warns that malicious mobile apps may steal data and login credentials, and advises downloading only from trusted sources. Read the CERT-In cyber-safety booklet for broader precautions.
Updates should preserve identity
An update from a different source can replace a previously trusted chain. Compare the app name, publisher information, signing or install warning, requested permissions and visible version history. An update that suddenly requests accessibility, SMS or device-admin control should be treated as a new risk decision, not a routine tap.