A fake WhatsApp hit 500,000 installs: Google Play review isn't a seal of safety

How does a copy of one of the world's most popular apps collect half a million installs in the store you were told to trust? That is what happened with a fake WhatsApp on Google Play. In our view, it ends the idea that "it's on the official store" means "it's safe."

What happened, briefly

According to Techbook, the fake used the same icon and name as the original. It apparently also borrowed screenshots and description text. The giveaway was the developer field. It read "Agment Assets sallu" instead of WhatsApp LLC. Mashable India, citing Android Authority, adds that the listing was only about a month old. The developer had published nothing else, and the real app has more than 10 billion downloads.

Two details make it worse. Screenshots shared on Reddit suggest the fake appeared as a sponsored search result for some users. And it reportedly used Google Play's Early Access program, where public reviews are disabled. Victims therefore couldn't warn anyone. What the app actually does with data hasn't been explained in the reports we've seen.

The blame is shared, but not equally

Users should check the developer name. It is a ten-second habit, and here it would have exposed the fraud. Anyone who installs an app called WhatsApp from a publisher nobody has heard of is taking a risk. We don't think blaming users is a satisfying answer, though. Someone searching for WhatsApp expects the store to put WhatsApp first. A sponsored slot looks like an endorsement, even if nobody intended it that way.

The fake didn't show up in every search, by the way. According to Mashable, the real app sometimes came first. We think that makes the trap harder to spot, not easier. Two people can search for the same thing and get different results. Nobody can then say with confidence, "I looked, and it was fine."

Google carries the heavier responsibility, because it controls the three things that made the scam work. It sells the ad placement. It runs the review that let the listing through. And it designed a program that hides reviews on new apps. Each of those features is reasonable on its own. Combined, they gave a brand-new, unknown account a stage, a megaphone and a mute button for its critics. Mashable also notes that Bitdefender had earlier warned that Early Access apps don't necessarily offer reviews that help users judge whether an app is legitimate. The risk was known.

Verify the publisher, at least for the big names

This isn't an isolated incident. Mashable notes that a counterfeit Chrome was reportedly downloaded more than 100,000 times and pulled just days earlier. When the same trick works twice in a few days, we'd call it a pattern.

Our proposal is simple. If an app uses the name or branding of a major company, the store should check that the publisher is that company before the listing goes live. It should also check before any ad can run against that name. That seems both feasible and cheap compared with the harm. Early Access apps that mimic a known brand could also be barred from hiding reviews, or at least carry a prominent warning.

We can't say what Google's internal checks look like. But a listing that stayed up for more than a month and collected 500,000 installs suggests they didn't work here. A handful of names, such as WhatsApp or Chrome, account for a huge share of what people search for. Protecting those names is the highest-return security work a store can do. It is also the easiest to measure.

What to do now

Check that the developer is WhatsApp LLC before installing. Treat sponsored results and unfamiliar publishers as warning signs. Don't take a download count as proof of legitimacy. If you installed the fake, uninstall it and get the real app. The advice is sound, but it shouldn't be the only line of defense. Our verdict: users should stay alert, and Google should stop treating identity checks as optional for the brands everyone tries to imitate.