A web page can only deceive you while you have it open. An app stays on the phone, and with the right permissions it can read an address you copied and see verification codes as they arrive in notifications. A fake app can do more than a fake website, so the checking has to happen before you tap "Install": where the download came from, who the developer is, and which permissions it asks for.
- Download order: open the exchange's official website, follow its link to the App Store or Google Play, and check the developer name before installing. Don't search the store by name and install the first result.
- An exchange app has no use for accessibility, SMS or overlay permissions. If it insists on them, stop.
- On an iPhone, being sent to "VPN & Device Management" to trust an enterprise certificate means the installer did not come through the App Store. Don't install it.
What a fake app can do that a fake website can't
What a phishing website can do is mostly confined to its browser tab. It collects what you type, and once the page is closed it can't reach you. It can't read your other apps or what you have copied.
An app stays after it is installed. During installation and use it asks for permissions: notifications, clipboard, photos, accessibility, overlay and so on, and each one you grant puts more within its reach. A malicious app with accessibility permission can read what is shown on the screen and simulate your taps. At that point it no longer needs to trick you into typing, because it can act by itself.
How fake exchange apps get onto a phone
The official app is downloaded through the official website and the app stores. Fake ones arrive by the routes below, and one of those routes is the app store itself.
Third-party download sites and aggregator pages
Installers on unofficial sites, the "app market" and "Android downloads" kind, may be modified versions. If an app can only be found in places like these and not in the official stores, don't install it.
Installers sent by direct message or in a group
"Support" or a "mentor" sends you an .apk file, a download QR code, or the line "the one in the app store is the old version, use my new one". An installer that bypasses store review could contain anything, and you have no way of knowing what.
Sideloading on iPhone: TestFlight and enterprise certificates
An iPhone won't install apps from just anywhere, so scammers go around that. They distribute a "beta exchange" through TestFlight, which exists for developers to run beta tests, or use an enterprise certificate or configuration profile (MDM) that you are told to "trust" before installing. Once you follow the prompt into Settings and trust an enterprise certificate, you have given it leave to run on your phone.
Search results and ads
You search "OKX download" or "Binance app", and a result near the top may be an imitation download page dressed up as the official one, with a download button that leads to a fake installer. Skip the results marked "Ad" or "Sponsored" in particular, since ad slots can be bought. As with fake websites, a high ranking does not make a page official.
Imitations listed in the app stores
The stores review apps, and imitations still get listed: a similar name, the same icon and screenshots, filed under a category such as Utilities, Productivity or Lifestyle. The stores sell ad slots too. So "search the store by name and install the first one" hands the question of which app is real to the search ranking. Follow the link from the official website, then check the developer name.
The three kinds of fake app: empty shell, phishing wrapper, malware
The three work differently, and what you need to fix afterwards differs too:
| Form | How it gets you | Tell-tale signs |
|---|---|---|
| Empty shell: takes deposits | The whole "exchange" is fake. You can register, deposit, and watch a balance and "profits" rise, but you can never withdraw. It is a screen for collecting payments. | Deposits go through smoothly and withdrawals keep failing; the app is only handed out privately or in groups; support exists only off the platform |
| Phishing wrapper: steals accounts | A realistic interface on the outside. The real exchange username, password and verification code you type are passed to the scammers as you enter them, and they use them to log in to your real account and withdraw. | After login it asks you to "verify again" or "link your old account" It asks for a seed phrase or private key |
| Malware: takes data in the background | The app carries a trojan that reads your clipboard (copied wallet addresses and seed phrases in particular), captures SMS codes shown on screen, and may alter the recipient address you copied. | Asks for accessibility, notification or SMS permissions; the phone runs slow or hot, or data use is abnormal |
The three can occur together: one fake app can be both an empty shell and a carrier of malware.
The FBI described the empty-shell kind in a July 2022 notification to the financial industry (PIN 20220718-001): criminals built investment apps using the names and logos of legitimate financial institutions and persuaded people to download them and deposit. When victims tried to withdraw, they were told to pay taxes first, and after paying they still could not withdraw. One of the FBI's recommendations to investors is to be wary of unsolicited requests to download investment apps, especially from people you have not met in person or whose identity you have not verified.
One point about the phishing-wrapper kind: "I only logged in to look and never deposited anything" does not mean nothing happened. The username, password and code reached the other side as you typed them, and the account they log in to with them is your account on the real exchange.
Clipboard swapping
An app carrying malware can watch the clipboard. You copy a wallet address to make a transfer, and what gets pasted has been replaced with the other side's address. An on-chain transfer can't be taken back once sent, so check the pasted address in full, including the middle characters. The first and last few are not enough. If a fake app swaps the recipient address itself in the background, nothing on the screen shows it, and the only protection is not installing the wrong app to begin with.
Which permissions not to give an exchange app
On installation and first launch, an app brings up several permission requests in a row. For an exchange app, stop before granting any of these:
- Accessibility: the riskiest one. It can read what is shown on the screen and simulate taps. Checking prices, placing orders and making transfers don't need it. If an exchange app insists on accessibility permission, go no further.
- Notifications / notification access: SMS codes and login alerts often appear as notifications, so an app that reads notifications may capture the codes.
- Clipboard access: used to steal or replace a wallet address or seed phrase you copied.
- SMS permission (Android): reads the verification codes you receive by text directly, without you being involved.
- Overlay / display over other apps: can place a fake input box on top of the real app, so that what you believe you are typing into the real app goes to the fake one.
A permission that doesn't fit the function is the warning
There is one test: does this permission have anything to do with checking prices, placing orders or making transfers? An exchange app that wants accessibility, your text messages or a permanent overlay has no functional reason for it, so don't grant it.
How to confirm the exchange app on your phone is the official one
Start the download from the official website
Type the official domain yourself, open the official site, and follow its link to the App Store or Google Play, or install the way its download page tells you to. Don't search the store by name and tap the top result, and don't install any installer someone sends you.
Check the developer name
On the store page, look at the developer field and see whether it matches the entity named on the official download page. If it shows an unfamiliar individual or an unrelated company, don't install.
Look at the listing date, the reviews and the category
Hold off on an "exchange" that was listed only days ago, has very few reviews, or has reviews that all read alike. Then look at the category it is filed under: an exchange sitting under Utilities, Productivity or Lifestyle doesn't fit.
On an iPhone, stop if you are asked to "trust a certificate"
An app installed from the App Store does not need you to go to Settings → General → VPN & Device Management and manually trust an enterprise certificate. If you are being walked through that, the installer did not come through the App Store.
Where to download the OKX and Binance apps
The order is the same for both: confirm the domain first, then download the app.
| Platform | Official domain to type yourself | Where to check a "new version download link" someone sends you |
|---|---|---|
| OKX | okx.com | OKX's Channel verification page, for checking whether a channel that contacted you is official. The page states that OKX's channel administrators will never direct-message you and will not ask for your personal, financial or account information. |
| Binance | binance.com | Binance Verify: enter a website address, email, phone number, Telegram or social media account to see whether it belongs to Binance. A download link someone sent you can be pasted in and checked first. |
- Type the domain from the table into the browser's address bar by hand. Don't click a search result, least of all one marked "Ad".
- On the official site, follow its download link to the app store and check the developer name before installing.
- After installing, bookmark the official site and use only the bookmark from then on. Turn on two-factor authentication (2FA).
Follow the same order for any other platform. If you are unsure whether a domain is an imitation, compare it using our domain checker.
- ☐ I typed the official domain by hand, opened the official site and followed its download link. I did not take the first result from a store or web search
- ☐ I did not click a result marked "Ad" or "Sponsored", or a download link or installer sent by a stranger
- ☐ The developer name is the exchange's own entity, and the download and review counts are what you would expect for a large exchange
- ☐ Installing did not require me to switch off the phone's built-in protection or to trust an enterprise certificate
- ☐ After installing, I bookmarked the official site and turned on 2FA
Signs the app you installed is fake
One of these is reason enough not to log in or deposit.
- Someone else (support, a "mentor", a group member) sent you the installer or a download QR code, and said "the one in the store is the old version".
- You had to trust an enterprise certificate, install a configuration profile (MDM), or switch off the phone's built-in protection before it would install or run.
- On installation or launch it insists on accessibility, SMS or overlay permissions that have nothing to do with trading.
- Deposits go through and withdrawals keep failing, or withdrawing requires paying a "tax", "deposit" or "fee" first.
- After login it asks you to "verify again" or "link your old account", or asks for your wallet seed phrase or private key.
- Support is available only in private chat on Telegram, WhatsApp or a similar messenger, with no proper ticket system inside the app.
You installed a fake app, logged in or deposited: what to do
Work through the steps below in order. If you typed a username and password into it, treat the account as compromised even if you never deposited anything.
Uninstall the app and remove certificates and profiles
Before uninstalling, screenshot its name, the developer name and where you downloaded it from, for the report. Then delete the app. On an iPhone, also go to Settings → General → VPN & Device Management and remove any enterprise certificate or configuration profile it installed. On Android, revoke its accessibility and other permissions before uninstalling.
Use a clean device for what comes next
This phone may already have had something planted on it. As far as you can, change passwords and check accounts from another device that you are sure is clean.
Change the passwords, sign out other devices and re-bind 2FA
On the clean device, open the real exchange from the official domain you saved yourself. Change the login password and any separate withdrawal password or PIN first, and the email password with them. Then sign out every other session, remove devices you don't recognize, and re-bind 2FA: remove it and set it up again.
Check login history, linked details, API keys and the withdrawal whitelist
Next, go through the device and login history, and confirm the linked email and phone number have not been changed. Delete API keys you don't recognize, and check whether an unfamiliar address has been added to the withdrawal whitelist.
If the app came into contact with a seed phrase, change wallets
If your wallet's seed phrase was ever typed into this app or read by it, assume it has leaked and move the assets still under your control to a new wallet as soon as you can.
If money you deposited can't be withdrawn, keep the deposit records, screenshots of the app and the chat with whoever sent you the installer, and see Scammed in Crypto? What to Do and Where to Report It for where to report. If someone then says a fee will get your withdrawal "unfrozen", read crypto recovery scams: "we can get your USDT back" first.
Also worth checking
- How to Tell If a Crypto Exchange Is Legit: 5 Checks: includes how to make sure you are not on a copy of a real platform's site or app.
- Safety checklist: the account settings to switch on once the real app is installed.