Android App Security · Inside an APK · Lesson 4 of 5

Where Apps Come From

Compare app sources and learn the checks to run before you tap Install.

Play review and Play Protect

Most Android apps come from Google Play. Before an app appears there, the developer needs a registered account, and Google checks submitted apps against its policies using automated tools and, for some apps, human reviewers. Apps that break the rules can be rejected or removed later, and repeat offenders can lose their developer accounts.

Review isn't perfect. Harmful apps do slip into Play from time to time, sometimes as a harmless app that turns bad after an update. That's why there's a second layer on the phone itself.

Google Play Protect is Google's built-in malware scanner on phones that have Google Play. It checks apps when you install them and also scans your phone from time to time. It covers apps from any source, not just Play. When you install an app from outside Play that it hasn't seen before, it may ask to scan it first, which sends details about the app to Google for checking.

If Play Protect finds something harmful, it can warn you, turn the app off until you uninstall it, or remove it automatically, usually with a notification. An optional setting, Improve harmful app detection, lets your phone send unknown apps to Google so new threats are found faster.

You can check Play Protect yourself. Open the Play Store app, tap your profile picture, then tap Play Protect. The settings there include Scan apps with Play Protect. Keep it on. Malware sometimes asks people to turn it off, and that request alone is a strong sign something is wrong.

Play Protect works best together with you. It knows about apps Google has seen before. You know whether an app came from a link a stranger sent you, and whether its permissions fit what it claims to do.

Other sources and checks before you install

You saw in Mobile Fundamentals that Android lets you allow apps to install other apps, source by source, with the Install unknown apps setting. Allowing your browser means any website could hand you an APK, so many people turn it back off once they're done.

Play isn't the only store. Samsung, Xiaomi, OPPO and other makers run their own, and F-Droid offers open-source apps. Each has its own rules, and some check apps much less carefully than others.

Google is also adding a new layer called developer verification. Developers who distribute Android apps register and verify their identity with Google, even if they never use Play. Enforcement began on September 30, 2026, in Brazil, Indonesia, Singapore and Thailand, on certified Android phones running Android 7 or later. Google says it plans to expand worldwide in 2027. Sideloading stays possible. Hobbyists and students can get free accounts to share apps with up to 20 devices, and experienced users can turn on an advanced flow that installs apps from unverified developers after a one-time, one-day wait. These details are new and may change, so check Google's developer verification page for the latest.

Wherever an app comes from, a few checks catch most fakes:

• Check the developer name. On the app's Play page, tap the developer to see their other apps, website and contact details. A bank app should come from the bank.
• Watch for lookalikes. Copycats use near-identical names and icons. Compare with the link on the company's official website.
• Read recent reviews, including low-star ones. Many short, vague five-star reviews posted close together are a warning sign.
• Compare permissions with purpose, as you did with the manifest.
• Be suspicious of paid apps offered free on forums or download sites. They're the classic disguise for repackaged apps.