A surge of deceptive apps just in time for holiday shopping
HUNDREDS of fake retail and product apps have popped up in Apple’s App Store in recent weeks – just in time to deceive holiday shoppers. The counterfeiters have masqueraded as retail chains like Dollar Tree and Foot Locker, big department stores like Dillard’s and Nordstrom, online product bazaars like Zappos.com and Polyvore, and luxury-goods makers like Jimmy Choo, Christian Dior and Salvatore Ferragamo.
“We’re seeing a barrage of fake apps,” said Chris Mason, chief executive of Branding Brand, a Pittsburgh company that helps retailers build and maintain apps. He said his company constantly tracks new shopping apps, and this was the first time it had seen so many counterfeit iPhone apps emerge in a short period of time.
Some appeared to be relatively harmless – essentially junk apps that served up annoying pop-up ads, he said.
But there are serious risks to using a fake app. Entering credit card information opens a customer to potential financial fraud. Some fake apps contain malware that can steal personal information or even lock the phone until the user pays a ransom. And some fakes encourage users to log in using their Facebook credentials, potentially exposing sensitive information.
The rogue apps, most of which came from developers in China, slipped through Apple’s process for reviewing every app before it is published.
That scrutiny, which Apple markets as an advantage over Google’s less restrictive Android smartphone platform, is supposed to stop any software that is deceitful, that improperly uses another company’s intellectual property or that poses harm to consumers.
In practice, however, Apple focuses more on blocking malicious software and does not routinely examine the thousands of apps submitted to the iTunes store every day.
With apps becoming more popular as a way to shop, it is up to brands and developers themselves to watch for fakes and report them, much as they scan for fake websites, said Ben Reubenstein, CEO of Possible Mobile, a Denver company that makes apps for JetBlue Airways, the PGA Tour and Pokemon Co, among others. “It’s important that brands monitor how their name is being used,” he said.
Apple removed hundreds of fake apps on Thursday after the New York Times inquired about the specific app vendors that created many of them. Others were removed after a New York Post article last week drew attention to some of the counterfeits.
“We strive to offer customers the best experience possible, and we take their security very seriously,” said an Apple spokesman, Tom Neumayr. “We’ve set up ways for customers and developers to flag fraudulent or suspicious apps, which we promptly investigate to ensure the App Store is safe and secure. We’ve removed these offending apps and will continue to be vigilant.”
In September, Apple also embarked on a campaign to review all 2 million apps in the App Store and remove “apps that no longer function as intended, don’t follow current review guidelines or are outdated”. The company says that a significant number of apps have been removed and that the review is continuing.
Despite Apple’s efforts, new fake apps appear every day. In some cases, developers change the content of an app after it has been approved by Apple’s monitors. In other instances, the counterfeiters change their names and credentials, and resubmit similar apps after one round of fakes is discovered.
“It’s a game of whack-a-mole,” Mason of Branding Brand said.