Scammed by the top result for 'Bitcoin wallet' in Apple App Store
Earlier today I decided to switch my Android for an iPhone. After moving all my apps I decided to make the jump and move my bitcoin from the android wallet. I searched for 'bitcoin wallet' on the Apple App Store, installed the first app I saw (as far as I could tell, looks legit), transferred bitcoin, and it immediately got sent off. Turns out this app was previously reported at least 12 days ago as a scam ( https://www.reddit.com/r/Bitcoin/comments/1b3q5wr/fake_wallet_on_apple_app_store/ ) but its still up there, #1 search result.
I get that I've failed to vet the app but honestly, how does a scam app become the #1 organic search result (not promoted) in the app store, topping binance, blockchain.com, and coinbase?
EDIT: linking to a screen recording that includes this post and comments of no repro:
Before removing the app - https://streamable.com/q2mulu
After removing the app - https://streamable.com/y5nhy7
178 comments
[ 0.19 ms ] story [ 191 ms ] threadWhat's crazy is that a scam app is the #1 organic search result for 'bitcoin wallet', above blockchain.com and coinbase.
(2) Do you think a legitimate wallet app will engage in the same black-hat SEO tactics a scam app developer will?
Well, the scammer got CAD $150k out of the reddit guy I linked to and I lost a slightly smaller amount - and we're just two out of who knows how many thousands of app store users that installed this app. I'd say people trust the top 5-10 results quite a lot.
> (2) Do you think a legitimate wallet app will engage in the same black-hat SEO tactics a scam app developer will?
I think all the black-hat SEO in the world should not be able to surpass the obvious value disparity compared to legit apps with hundreds of thousands of installs and hundreds of reviews.
You can, since 2021. https://www.theverge.com/2021/10/4/22705405/apple-report-a-p...
Perhaps they let this one slip through because their team was too busy dragging out the review process for our cannabis compliance application, they can only afford so many reviewers after all. We wouldn't want children accidentally getting their hands on regulatory compliance data for deadly deadly cannabis. (which could happen with our application, after they had signed up and verified their agency cannabis license (which only takes many months/years and $$$$$s to get))
But, even at this stage, Apple is still “the best”, because of the slower pace of the corruption and in comparison to the toxic dumpster fire of the alternatives.
Android and Windows are spyware/malware masquerading as OSs.
On Apple though, you don't have anything other the App store. That's something to consider. On Android, you have the chance to install F-Droid for example.
It's possible that it's just because it was literally called "Bitcoin Wallet", an exact match for your search, or boosted by fake reviews, or it was actually an ad that you didn't notice. Though it shouldn't have gotten past review at all
But I don't really understand why you'd blindly trust some random app?
Also, would be interesting to take a look at the app, sadly know nothing about ios apps or how to get the IPA, only android.
The question is why is the scam app the #1 organic search result? For a new app with such scammy reviews and questionable metadata I would expect it to be #30 in the list. For context, the app store reports the scam app as #85 in all finance apps.
The real answer is that this has been happening for years. You can pay companies to pump up your app to the top of App Store search results or "app categories" lists, and they'll have farms of iPhones/Androids downloading apps to pump up their rank, and giving them 5 star reviews.
There have also been repeated problems with copycat apps that impersonate real indie apps (and sometimes end up earning more than the real app), which should have been a warning sign of the problems of App Review. Google "app store copycat" and you'll see.
Perhaps because Apple claims their apps go through a review process, and one would hope this would have failed that process? That's what Apple claims the value proposition of their 30% cut and closed platform are.
When I first installed the app it was the first search result. I can't go back in time and prove it because I'm not paranoid and I don't screenshot the result of every search in every app store and search engine.
I reported it. I'm not trying to rally a mob against Apple. The bitcoin is gone.
I'm trying to prevent others from suffering the same fate as me. Based on what I'm reading in the comments here some other people in the world do trust apple app store search results, and I believe they've gained something from my post.
Oh, wait
Gmail / Google are open, the App Store is closed and supposedly vetted and guarded. Apple sells to its customers security, quality, and trust. It’s one of the reasons one pays 2x for an iPhone. All of these promises of a better ecosystem have been broken through this experience.
One of the supposed advantages of the closed App Store is to absolve (to some extent) the user of having to do said due diligence.
Also, it’s not like it’s impossible. Google are doing it well - show me a scam app that’s in the top 10 of the play store for bitcoin, banking, finance etc. Hardly any to be found.
Edit: Unless that app had a ton of reviews removed recently, I recommend in the future looking at that number. It is crazy that they've gamed it up to #97 in the finance charts according to the app store listing for sure, though the Play store is not immune to this manipulation.
just tried it
I dare to think how many people this lures inscammy ads plastered everywhere is what I'd expect from Google products
not for the Apple equivalent that commands a significant price premium
I won't search the App Store anymore. I go to the web site for the app I want and get the App Store link that way.
I wish the App Store listings would specify the domain of the entity they come from in plain text, backed by a validation method similar to what we do for TLS certs.
Apple should remove App Store search ads altogether (I'm sure they won't). By definition they won't give you the app you searched for, because the keyword will be bought by a competitor or even a scam.
You're going to hate Amazon.com.
What is CFD gambling? When I read “CFD” I always think of computational fluid dynamics and so “CFD gambling” sounds pretty cool to me. Obviously I do know I’m just overfitting to a TLA and I’d like to know what it actually means.
in this case: extremely short term highly leveraged bets
If you’re curious, Four’s description is “Shop Now, Pay Later.”
Everyone should be better than that, but as far as Apple specifically, they're really no better than any other hypermegacorp. Apple's a company, it doesn't give a damn about you, it only gives a damn about enriching its owners.
Also, I’m sure this kind of thing hurts their prospects in antitrust cases (like in the EU)
Has this ever really been the case?
The same is still somewhat true for macOS where for the average web browsing user, macOS + Safari needs less memory than you would need on Windows. This is also a fact, but it doesn't help power users.
It’s cool to crap on Apple and all these days but this is all categorically false. What you are referring to is the Ad on the top of the page. It’s clearly labeled as ad and has a light blue box around the whole ad.
I tried all those things you mentioned and the first result after the clearly labeled ad is what I searched for.
> - my bank? I get crypto.com
Although crypto.com is not a bank, they seem like a legit business and not a scam. Many people are using crypto.com: I know one person who has one such card and I asked a waiter if he had already seen cards like that (waiters gets to see many credit/debit cards a day) and he answered me that they weren't that uncommon.
> - official government app for paying my tax? intuit product
They may be using shady tactics but they are not a scam.
I don't think 'gambling app' is a fair description given it's a regulated security, any broker that truly offers CFD trading is (1) going to be legit; (2) going to be competing with the broker you were searching for for result space.
Of course to serve its users any app store should massively prioritise the word/brand (incl. typos) you actually search for though.
You can (and some people do) call buying shares 'gambling' too, at some point it just comes down to what our definitions are and it's not very interesting.
Yeah well like I said, definitions. If most investing is gambling then sure, I just don't find that useful.
Anyway the initial comment I was responding to was 'looking for my broker but got CFDs'; my point was they got a different broker. It's still a bad search result, but it's not a weird scam, it's just a competitor. It's not the same as looking for my bank but got crypto exchange at all.
This is the actual dictionary definition of how I would describe investing to someone who'd never heard of it. Investing money is gambling. It's not a bad word or something to be ashamed of, and I'm not trying to be a pedant (I say as I type a long comment starting with a dictionary definition), I just think it's important to recognize & remember at all times so you don't lose everything.
I get what you mean about the broker app. App store searches are bullshit.
Er, no. "Contracts for Difference" are the new binary options.
They're in the category that, while they theoretically can be used by skilled investors, anyone offering them to retail punters is up to no good. Because those punters are going to lose money to them hand over fist.
But they're not 'up to no good', you may not like it, but this is allowed and fully above board. If you search 'HL' and get 'Trading212: shares & CFDs' that's a bad search result, but it's not a scam, they genuinely and legitimately offer that, and compete with HL (which doesn't offer CFDs except through some kind of tie-up with IG).
This won’t fit with the manufactured popular understanding, but at the current time, Google protects you from fraud and scam better than anyone.
I have been unfortunate enough to be scammed recently from a bing search result (ad). (It was a new computer and I decided to use Edge and bing was the default search).
Apple, Microsoft etc. are rookies in this game. Google just has the benefit of experience and hence is much safer now than anyone can ever become in the near future. Because of this, scammers are much more likely to target other platforms… which happen to be Apple, Bing, Facebook etc.
I have to disagree. Czech Youtube is currently full of scam ads with photos (and sometimes even bad deepfakes) of Czech president and other public figures, supposedly endorsing some investment product that yields you like 50% profit. I keep reporting these, and I know some people who do too, but ~80% of those reports get handled as "we determined no violation of our rules".
Also, it's not in my "preferred videos", they are paid ads, and they appear to many people, maybe it wasn't so clear from my comment
In fact, I just used all your searches on Google play and got
- my bank
- the train company app
- my broker
- hmrc
The next 4 or 5 in each case were also legit. Maybe this is really something to be aware of if switching to apple? Certainly would not have been something I would have been expecting from apple (though I am pretty careful about vetting apps).
I would also expect products with premium pricing to not contain ads.
- Around a lot of things software, including the Play Store, Google’s safety and security, for all its ads, tracking and shenanigans, are real, largely verifiable, discussed openly, and pretty fucking robust (not to mention, most of it are actually open).
- Apple’s? Smoke and mirrors! Essentially some vague shit which often ludicrously boils down to Safest Shit Ever On an iPhone™ (and doesn’t go further than that) and never discussed or even offered a glimpse of.
Add to this the fact the iPhone users are dumber and more prone to expoits, so of course hackers would rather focus on App Store.
For me on apple UK app store:
my bank - Ad: another legit bank. First result: my bank
Train company - Ad: a generic legit train booking app. First result: the train company
My broker - Ad: another broker. First result: my broker
Official government app for paying my tax - ad: a general tax app. First result: government app.
It stands to reason that they won't show an ad for the thing you're searching when it's the first organic result so I don't find this surprising.
[1] I have two and tried both. Results were the same with a different legit bank as the ad each time.
A longtime HN commenter just switched to iOS? Seriously?
- Spotify -> Deezer
- Uber -> Heetch
- UberEats -> Deliveroo
- Deliveroo -> Ubereats
- My bank -> crypto.com
I have no idea why Apple allows buying trademarks/full app names as an ad keyword. Perfect matches should always have the app first, not an ad.
Is there something in the AppStore rules that prevent apps from buying the keyword ad for their own app?
Because unlike a regular search query, app store searches tend to be for app names, which are unique. Advertisers won't be interested unless bidding on brand names were allowed.
Then I figured a legit apple app could generate a wallet and I could transfer the bitcoin between them. Which is what I did. The apple app indeed received it and promptly sent it off somewhere else. What's even crazier is that the apple app shows this info! You'd expect the scammer to hide the scam but I suppose it just made it easier to pass the app store inspection.
Did you try moving the crypto back to your Android wallet? Sometimes they do move to cold storage, or invest into DeFi schemes. It will be hidden in their T&C.
The researchers who conducted the report found that retail giants such as Amazon, American Airlines, Lego, Pizza Hut, and Samsung were all victims of identity fraud within Google Search Ads.
Here's a Google SERP for "Facebook" which shows Facebook as the URL, redirects to an Apple security scam: https://youtube.com/shorts/gTEuqXYAp58?si=lzFV9mfX31_8nzd1
Google even vouches for the advertiser:
https://twitter.com/leanmediaorg/status/1724467969344905534/...
But hold on a sec. Is this verified by others? The guy in the video cuts to a screenshot, which doesn’t show the resulting url or how he got there, so it’s hard to tell what happened.
Google vouches that the advertisers is who is he says he is. Google is not vouching for the reputation if the advertiser.
It sounds like somebody is burning developer accounts to keep reposting the scam app. Not unlike people being banned from a website and then resubscribing with a different email or through a VPN or whatever. It slipping through into your results isn't so much plain neglect as it is an arms race that Apple is on the losing side of this time.
Robust algorithmic ranking and moderation at scale is a myth, though, and you can find this happen pretty much everywhere. This one will probanly get squashed with some near-term update to their algorithm, and then get compromised again sometime later since crypto is so ripe for scamming.
You can't escape personal due diligence and "it was top ranked!" has never been that.
> You can't escape personal due diligence and "it was top ranked!" has never been that.
On one hand that's a fair point and I should've known better. OTOH I think it is legit to trust top app store search results to return quality apps, especially if there is a massive disparity between their quality. The scam app has obvious repetitive spam reviews. The developer's website is terrible and the submit button doesn't even work. This is basic quality control on apple's part. If every single app store user needs to manually vet every single app they install to the proper extent there would be a fraction of a fraction of the installs and respectively, a fraction of a fraction of the revenue.
Consider the extent of lawsuits between apple and companies with app store apps - does it not strike you that apple protects that revenue stream? Wouldn't it make sense to give app store users a sense of trust in the top search results?
Apple continually makes claims that the closed ecosystem is essential to the safety of their customers, that they have a robust review process, and that their customers choose them because of the safety they provide. Apple should stop repeating these claims if they are not, in fact, reliable protection against scams.
Schiller, an Apple veteran who once ran its marketing machine, said the moves to break the company’s closed ecosystem for software will undermine the privacy and security the company has worked to build into its products and services. “This isn’t our first choice,” he said. “We always want to have the highest standard everywhere in the world but we also have the requirement to meet the legal requirements in the local markets. “In the App Store we have a lot of signals that we are looking for every day to find scams and stop them,” Schiller said. “With these new marketplaces we won’t have visibility into those issues.”
Right.
https://files.mastodon.social/media_attachments/files/111/95...
Same is now happening with iOS sideloading, instead of robust antimalware based on heuristics and app behavior (like Google Play Protect), they'll keep relying on blunt instruments like notarization. Doubt it'll keep users safer. Maybe it's NIH syndrome?
To be fair many crypto wallet apps are deceptively simple applications.
So many of them are blatantly scams that it's not credibly "human error".
As for the example - can’t replicate, but seems crazy to put a seed phrase into some random app you didn’t get yourself. Even if the app wasn’t a scam.
It's just people behaving in a certain way, and that being exploited. If people had a different behavior, the exploit would be different too.
I think there are ~ 3m apps available right now. Apple is the only place (currently) to sell apps, or buy apps. They interpose themselves, and do a poor job of things. How can a buyer make his apps visible? How can a seller find anything?
There should not only be more app stores, there should be markets and communities and personal apps.
I have only 1 other app of this variety on my phone currently and haven’t used it or searched for anything crypto related including months.
My theory is, they paid for an Ad in a specific region and hence it started showing on top, people started downloading in that region, and that boosted the overall ranking for that app and hence people from other regions are seeing it among top results, even though its not an Ad there. Irrespective of the rating or freshness of the app, since it is getting downloaded in one region (because it is an Ad there), automatically it goes to top in other regions.
This trick can be used by other apps also, considering it would be cheapter to buy the top Ad spot in India and then it organically rises to the top.