Scammers and fraudsters are always trying to drain people from their hard-earned money.
And through the web and mobile, things have gotten easier for them, simply because they don't have to meet face-to-face with their targets, and that they can hide behind the fact that people are sometimes forgetful and not paying attention.
Among the many ways, is by using what's called fleeceware apps.
These apps are malicious right from the start, designed to tempt unsuspecting users with the promise of a short subscription trial for a seemingly useful service, to then charge them with an exorbitant fee for very basic services.
And this time, researchers at Avast discovered a total of 204 fleeceware apps, that together, have a combined downloads of over one billion, and managed to earn $400 million in revenue on both the Apple App Store and Google Play Store.
On its blog post, Avast wrote that:
Fleeceware is a term that refers to a mobile app that comes with excessive subscription fees. The thing is, those apps generally have no unique functionality and are merely conduits for scams.
Users are typically offered a 3-day trial, after which they are charged.
According to Avast, the malicious developers of the fleeceware seem to prey on users who do not understand subscriptions.
For example, they target younger audiences through playful themes and catchy advertisements on popular social networks with promises of ‘free installation’ or ‘free to download’.
" [...] these applications are actively advertising on major social networks such as Facebook, Instagram, Snapchat and TikTok. Due to this scheme’s lucrative nature, the actors are likely investing substantial amounts of money to further propagate these apps via popular platforms," Avast explained.
And by the time their parents notice the weekly payments, the fleeceware may have already extracted significant amounts of money.
On its research, the team at Avast found over 200 apps on both stores, that charged users up to $3,432 a year after they were given a trial to try out the app. And making things worse, the apps are making use of the loopholes on both stores to keep charging people, even when the apps have been uninstalled.
The only way to stop the subscription, is to cancel the fleeceware apps' subscription before deleting the apps.
Fleeware apps aren't new, and both Google and Apple are aware of their existence.
The two companies have taken several steps to protect their users from malware and other potentially unwanted software on the Play Store and the App Store. But in the case of fleeceware, the two companies are having a hard time because of the loophole that exists on their respective systems.
Avast have a few solutions that Apple and Google should follow.
First of all, the researchers think the two companies should change the way subscriptions work. If a user downloads a free app with a trial, and after this trial is done, the store should send an alert if the user wants to subscribe to the app and not automatically start charging right after it finishes.
The second solution, is to provide a better pop-up or notification when users delete an app they've subscribed to. Both Apple and Google have this in place when users try to remove a subscribed app, but Avast thinks that the two could do better.
For users, Avast also gave some tips to avoid fleeceware scams:
- Be careful with free trials of less than a week.
- Read the fine print.
- Be skeptical of viral advertisements.
- Shop around.
- Secure your payments.
- Discuss the dangers of fleeceware with your family.
And if ever people fell as victims, they should refer to their respective operating system's own method to remove the subscription.
For example, Apple users can go to Settings to select Subscription, and Android users can do so by going to the Play Store and select My Subscription. They can Cancel any subscription they may have there.
While the companies may choose to offer a refund as a goodwill gesture in some cases, it should be noted that neither Google nor Apple is responsible for refunds after a certain time period. So for those who have been scammed by fleeceware, they may try contacting the developers directly, or request a bank chargeback.
