Fake VPN Apps: How to Spot the Ones That Steal Your Data
A fake or poorly made VPN can see your traffic, use your connection or install malware. All three have been documented.
This article separates three real cases and explains how to spot a dubious app before you install it. The cases involve Android, and the sources date from 2024 and 2025.
Three ways a “VPN” can harm you
They are not the same thing, so it is worth keeping them apart. Not every case involves stolen money.
| Case | What it does | How it reaches your phone | Source |
|---|---|---|---|
| Uses your connection | Routes other people’s traffic through your device | Free VPN apps | Kaspersky, 2024 |
| Installs a banking trojan | Takes control of the phone and makes fraudulent transactions | App installed outside Google Play | Cleafy, 2025 |
| Hidden owners and flaws | Weak encryption and unclear ownership | App store | Citizen Lab, 2025 |
1. A VPN that uses your connection
In November 2024, Kaspersky explained that several free VPNs were used to build a botnet called 911 S5. Authorities dismantled it in May 2024.
Anyone who installed them turned their device into a proxy server that routed other people’s traffic. The administrators sold that access to other criminals. They used it for cyberattacks, money laundering and mass fraud.
That statement does not mention theft of banking data from the people who installed the app. The risk was different: your connection being used in crimes.
2. A VPN that installs a banking trojan
In September 2025, Cleafy described a banking trojan for Android. It arrived with an internet TV app that included a VPN.
It was not downloaded from Google Play. It asked for permission to install unknown apps and to turn on Accessibility services. Those services can read the screen and tap buttons.
With that, the attackers took control of the phone and made fraudulent transactions. According to Cleafy, the most affected countries were Spain and Italy.
3. A store VPN with hidden owners
In August 2025, researchers at Citizen Lab and Arizona State University analysed highly downloaded VPNs on Google Play. They found three families of apps linked to each other, with more than 700 million downloads.
In two of those families, all the apps shared a password written into their code. According to the study, someone listening on the network could decrypt every user’s communications.
The study does not say that every VPN in the store is like this. It does show that an official store is not enough.
In its November 2025 advisory, Google explains that some apps pose as legitimate VPNs. They deliver malware that steals browsing history, messages, financial credentials and crypto wallet data.
Signs of a dubious VPN app
One sign proves nothing. Several together are a reason not to install it.
| Sign | Why it matters | Source |
|---|---|---|
| Asks for permissions that do not fit | INCIBE advises distrusting access to data unrelated to the service | INCIBE |
| You do not know who makes it | INCIBE recommends researching the provider and reading its privacy policy | INCIBE |
| It is free and does not explain how it earns money | Free VPNs are often funded by user data | INCIBE |
| You are asked to install it outside the official store | Google recommends downloading VPNs only from official sources. The Cleafy case was installed outside Google Play | Google, Cleafy |
| It asks you to turn on Accessibility or install other apps | With those permissions, an app can read the screen and tap buttons for you | Cleafy |
How to check a VPN before installing it
Avoid links from ads, messages or websites. Google advises being sceptical of free offers and not installing unknown apps.
Look at the developer, its website and its privacy policy. It should say what data it collects and who it shares it with.
Since January 2025, Google Play marks VPN apps that pass an independent security assessment (MASA Level 2) as “Verified”. It is a help, not a guarantee.
A VPN does not need, for example, your contacts or your messages. If it asks for them, do not install it.
If it is free, find out what it lives on. If it does not explain, be wary.
Google requires, among other things, at least 10,000 installs, 250 reviews and 90 days in the store. A small or new VPN may have no badge and still be legitimate. That is why the badge is just one more clue.
What to do if you have already installed one
Do it as soon as possible. Do not wait to see whether anything happens.
In Android settings, look for those two sections. The exact name varies by phone. Remove the permission from any app you do not recognise.
Turn on Google Play Protect or use a trusted antivirus.
Start with your email and your bank. If you suspect a trojan, do it from another device.
If there are transactions you do not recognise, call your bank and file a report.
In Spain, INCIBE has a free, confidential cybersecurity helpline: 017 (page in Spanish). Elsewhere, contact your national cybersecurity agency.
Does a free VPN make sense?
INCIBE warns that many free VPNs are funded by collecting and selling user data. That does not mean they are all dangerous. It means you should know who offers it and how it earns money.
If it meets the five steps above, you can consider it. If it does not, it is better not to install it. In other articles we analyse two specific services: Windscribe free and Proton VPN.
Frequently asked questions
Is a VPN from the official store always safe?
No. The Citizen Lab study analysed Google Play apps with flaws and unclear owners. Being in the store lowers the risk, but does not remove it.
Why does it matter who is behind the VPN?
Because the company that provides the VPN can see the traffic that passes through its servers. The Citizen Lab study points this out.
What about the iPhone?
The cases we cite involve Android. We have not found recent official sources on the iPhone that we can cite, so we make no claims. The checks on the store, the developer, the permissions and the funding work on any phone.
Do I need a VPN?
It depends on what you want it for. A VPN creates an encrypted connection between your device and a server. We cover public wifi networks in this article.
A VPN is not safe just because it is called a VPN.
In the cases we reviewed, the problem appears when you do not know who is behind the app. It also appears when the app is installed outside the official store.
Before installing one, check the store, the developer, the permissions and how it is funded. If something does not add up, do not install it.
Sources
Kaspersky: rise in apps posing as VPNs (20 Nov 2024).
Cleafy: Klopatra, a new Android banking trojan (30 Sep 2025).
Citizen Lab: Hidden Links, secret families of VPN apps (14 Aug 2025).
Google: fraud and scams advisory (6 Nov 2025).
Android Developers Blog: “Verified” badge for VPN apps (28 Jan 2025).
INCIBE: connect to your company securely with a VPN (9 Aug 2018) (in Spanish).
INCIBE: free or paid, what you need to know about VPNs (in Spanish).
Updated in November 2026.
YOU MAY ALSO LIKE
Public WiFi: Why You Should Never Connect Your Bank There
