‘Fleeceware’ apps overcharge users for basic app functionality

guest · Sep 25, 2019

‘Fleeceware’ apps overcharge users for basic app functionality
Unscrupulous publishers take advantage of Play Market policy loopholes to charge app users hundreds of dollars
September 25, 2019
https://news.sophos.com/en-us/2019/...overcharge-users-for-basic-app-functionality/

SophosLabs have discovered a collection of Android apps on Google’s Play Market whose sole purpose appears to be to severely overcharge users for mobile apps that provide very simple functionality available on low-cost or free apps.

The app developers take advantage of a business model available within the Play Market ecosystem in which users can download and use the apps at no charge for a short trial period. When the trial expires, if the user who downloads and installs one of these apps hasn’t both uninstalled the application and informed the developer that they do not wish to continue to use the app, the app developer charges the user.

Because these apps exist in a categorical grey area that isn’t overtly malware, and isn’t a potentially unwanted app (PUA), we’ve coined the term fleeceware, because their defining characteristic is that they overcharge users for functionality that’s widely available in free or low-cost apps.
Click to expand...

The fleeceware business model
Because the apps themselves aren’t engaging in any kind of traditionally malicious activity, they skirt the rules that would otherwise make it easy for Google to justify removing them from the Play Market. Their developers also seem to be very good at staying under the radar from security vendors. Even so, there are other characteristics of these apps that make them less-than-desirable.

In many reviews for fleeceware apps, users report that they failed to unsubscribe from the trial period, and get charged very high amounts of money. In the case of one QR code reader app, the developer charges users €104.99 after 72 hours.
As we mentioned previously, 14 other apps that engaged in a similar business practice have subsequently been pulled from the Play Market by Google representatives after we inquired about the business model.
Click to expand...

guest · Nov 12, 2019

Beware of fleeceware
November 11, 2019
https://www.kaspersky.com/blog/beware-of-fleeceware/29204/

The cost of curiosity
In late September, infosec researchers found a collection of calculators, QR code scanners, photo enhancers, and other programs with basic functionality on Google Play at clearly inflated subscription prices of up to €200 per month.
Not technically malware
You might ask why such apps were allowed onto Google Play in the first place. Alas, technically these “gilt-edged” calculators and QR scanners do not violate the store’s rules. They perform their stated function, do not request unnecessary permissions, and do not contain malicious code. As for the subscription prices, no current rules would bar them from Google Play.

For many countries, there is a set upper limit — but it’s the same for an advanced video editor, which might genuinely be worth the money, as it is for a QR scanner or flashlight app.
At the time of this writing, the ceiling in the US is $400, while in most of the European Union and the UK it’s a bit less — €350 and £300 respectively. If the subscription price falls below this, the store approves the app whereupon users decide for themselves whether to cough up for certain features.
Click to expand...

guest · Jan 14, 2020

Fleeceware is back in Google Play – massive fees for not much at all
January 14, 2020
https://nakedsecurity.sophos.com/20...google-play-massive-fees-for-not-much-at-all/

Technically, the apps themselves aren’t malware, because the code in the app doesn’t do anything illegal, dangerous, sneaky, snoopy, subversive or surreptitious.
The treachery lies in the payment model – the fleeceware we identified back in September 2019 didn’t charge a fee for the app, but instead sold you a subscription to go along with the app.

So even apps that do very little can charge a lot, and hope that you forget to cancel them before your brief trial expires.
Jagadeesh has revisited the Play Store and found that new fleeceware apps seem to appear whenever old ones get removed, so there are still plenty of “moneytrap apps” waiting to catch out trusting or unsuspecting users.
Click to expand...

For a list of apps, sample screenshots, the charges they’re asking, and some good advice on how not to ge tricked, please read Jagadeesh’s article Fleeceware apps persist on the Play Store.
But on the app store of the world’s largest mobile operating system maker, we’d like to think that users would never find themselves being charged hundreds of euros for an unremarkable app.
Click to expand...

SophosLabs: Fleeceware apps persist on the Play Store

Fleeceware remains a problem on Google Play, where Android users still run the risk of being charged hundreds of dollars or euros for “subscriptions” to apps
Click to expand...

guest · Apr 8, 2020

Don’t let fleeceware sneak into your iPhone
A SophosLabs investigation reveals fleeceware app publishers are also operating on Apple’s App Store for iPhones and iPads
April 8, 2020
https://news.sophos.com/en-us/2020/04/08/iphone-fleeceware/

Since we began writing last year about the consumer-hostile trend in mobile apps that we’re calling fleeceware, the number of apps we’ve discovered that engage in this practice have only increased. In the first two articles we wrote about fleeceware, we covered various Android apps in the official Play Store charging very high subscriptions for apps of questionable quality or utility.

In this latest round of research, we found more than 30 apps we consider fleeceware in Apple’s official App Store.
Many of these apps charge subscription rates like $30 per month or $9 per week after a 3- or 7-day trial period. If someone kept paying that subscription for a year, it would cost $360 or $468, respectively. For an app.
Advertisements drive more people to fleeceware
If you find yourself wondering why users would even consider installing apps such as these, it’s probably thanks to advertising. These apps are advertised through various popular platforms, including in YouTube videos or on social media platforms like Instagram, TikTok, and even in ads that appear within other apps.
Click to expand...

Both iOS and Android face a fleeceware problem
Fleeceware is a problem on both the Android and iOS mobile platforms. The list below is representative of the fleeceware apps we’ve seen at the time of this writing.

Users should remain vigilant and carefully scrutinize the terms for purchasing or “subscribing” to apps promoted through in-app advertisements. If $30 a week seems like a lot to spend on astrology, a barcode reader, or an app that will show you what you’ll look like when you’re 80 years old, find another app.
Fleeceware Apps List [...]
Click to expand...

guest · Apr 16, 2020

Google tightens Play Store rules to stop Android app subscription scams
Clearer information about free trials and subscription costs
April 16, 2020
https://www.theverge.com/2020/4/16/...droid-apps-subscription-scams-policies-trials

Google has announced a series of new policies to make Android’s in-app subscriptions more transparent to users. Starting on June 16th, apps will have to be clear about the terms of their paid subscriptions, and free trials and will need to provide a transparent way for users to cancel them.
In addition to the rules for app developers, the Google Play Store is also providing more information to users directly, notifying them when free trials end or when long-term paid subscriptions are about to renew.

The aim of the new subscription policies is to cut down on misleading subscriptions and so-called “fleeceware,” where apps are unclear about the terms of their subscriptions and offer free trials in the hopes of tricking users out of their money.
Apps that trick users into signing up for costly ongoing subscriptions are not only making it onto the Play Store, but in some cases, they’ve even entered the top charts, Android Police reports.

On Google’s side, it’s also introducing new features to provide more information to users about app subscriptions directly. Most notably, users will now be emailed before a free trial or introductory pricing is about to end or when a longer-term three-, six-, or 12-month subscription is due to automatically renew.
Click to expand...

guest · Apr 17, 2020

What is Fleeceware?
April 17, 2020
https://www.securemac.com/blog/what-is-fleeceware

These days, we’re all spending a lot of time online, and many of us are trying out interesting new apps to stave off cabin fever. If this describes you, then there’s a threat that you should know about: fleeceware. In this short article, we’ll tell you what it is, how it works, and what you can do to stay safe.

The term “fleeceware” was coined by the British security researchers who have been investigating it. It refers to apps that charge an excessive monthly subscription fee after a brief trial period has ended — even if a user has uninstalled the app from their device.
The fleeceware developers know exactly what they’re doing, and don’t make it easy for people to get their money back after they’ve been “fleeced” by the deceptive software.
Click to expand...

guest · Nov 11, 2020

Avast warns of Minecraft skin, mod apps fleecing ‘millions’ of Android users
Ridiculously expensive subscriptions are costing users as much as $120 per month
November 11, 2020
https://www.zdnet.com/article/avast-warns-of-minecraft-apps-fleecing-millions-of-google-play-users/

Active Minecraft modding apps on Google Play are fleecing subscribers through hefty payment models, researchers have warned.

leeceware can be classified under the same umbrella. While not necessarily dangerous, fleeceware apps can still deprive unwitting users of their hard-earned cash by providing poor goods or services through extortionate, automatic subscriptions.
Gaming is a popular arena for fleeceware as add-on skins, wallpapers, virtual items, and mods may be highly sought by dedicated users.
Click to expand...

This is how they work: fleeceware apps will offer a "free" trial for a number of days before a user is automatically signed up to a subscription. These fees can be extortionate, and in the apps found by Avast, the most expensive were $30 per week, or $120 per month.

"Fraudsters expect the user to forget about the installed application and its short trial, or fail to notice the real subscription cost," the researchers note.
In total, seven Minecraft-based apps have been reported to Google, but as of the time of writing, all of the apps are still available.

The Android apps reported are: Skins, Mods, Maps for Minecraft PE, Skins for Roblox, Live Wallpapers HD & 3D Background, MasterCraft for Minecraft, Master for Minecraft, Boys and Girls Skins, and Maps Skins and Mods for Minecraft.
Click to expand...

Five out of the seven apps, however, have still been downloaded over one million times.

It is not enough simply to uninstall these types of apps -- you have to remember to cancel the subscription, too. In order to do so, go to the Google Play Store's menu and navigate to the "Subscriptions" tab to remove them entirely.
Click to expand...

Avast: Fraudulent Minecraft apps deceive millions of Google Play users

These scammy apps fool users into spending upwards of hundreds of dollars per month
Click to expand...

guest · Jul 18, 2022

The App Store still has a fleeceware problem that affects millions of iOS users
Apple takes a cut of every sale, and that includes sales generated by scam apps
July 18, 2022

Why it matters: Apple says it reviews well over 100,000 apps and app updates every week, of which only 60 percent make it through thanks to a strict vetting process. However, scam apps still manage to thrive on the App Store and generate a significant amount of revenue for both their developers as well as the Cupertino giant which gets a commission on every sale.

Scam apps are nothing new, but Apple and Google have yet to develop a proper solution to prevent them from making it into their mobile app stores. The most recent estimate is that developers of fleeceware apps raked in $400 million from unsuspecting users in recent years.
Click to expand...

Google's Play Store is known to have a less strict app vetting process, but fleeceware can make its way into Apple's App Store.
Still, fleeceware developers have been taking advantage of the free trial mechanism of the App Store and continue to do so today.

According to a report from VPNCheck, no less than 84 fraudulent iOS apps still thrive a year after being discovered by security firm Avast. Together, these apps make over $100 million in annual revenue if we go by SensorTower figures.
Click to expand...

VPNCheck: 84 Fraudulent Apps on the AppStore Still Trick Users Out of More Than $100M Annually

After more than 15 months in the know, Apple still hasn’t taken the necessary action on these iOS apps scamming its users. Which ones? Here is the list.
Click to expand...

Log in or Sign up

‘Fleeceware’ apps overcharge users for basic app functionality

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

‘Fleeceware’ apps overcharge users for basic app functionality

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches