Why VPN apps are a target
A VPN app asks for something most apps never get: control over where your internet traffic goes. On Android, that is a dedicated VPN permission. Once you tap “OK,” the app's servers sit between you and every site and service you use while it is connected.
A trustworthy provider uses that position to encrypt your traffic and pass it along. A careless or dishonest one can log it, collect data about it, inject ads into it or simply leak it. You are not removing a middleman when you install a VPN. You are choosing a new one.
This is not a hypothetical worry. Researchers from CSIRO, ICSI, UC Berkeley and the University of New South Wales examined 283 Android apps on Google Play that request the VPN permission. According to ICSI's summary of the study, 84% leaked user traffic and 18% did not use encryption at all. Some apps intercepted encrypted web traffic, and some injected JavaScript for tracking, advertising or redirecting shopping traffic to partners.
That research is several years old, and the app stores have added safeguards since. The incentive has not changed, though. Whoever controls a VPN app controls a pipe full of personal data.
Being a VPN does not make an app safe. A VPN shifts your trust from your internet provider to the VPN company. With a fake or unknown app, you are handing that trust to someone you cannot identify.
The Federal Trade Commission's consumer tips on VPN apps come down to four checks: research the app before you get it, review the permissions it requests, make sure it actually encrypts your information, and find out whether it shares your information with third parties. Everything below is a practical way to do those four things.
Red flags in the store listing
Most fake or risky VPN apps give themselves away on the listing page, before you ever tap Install. Here is what to look at and why it matters.
| Red flag | How to check | Why it matters |
|---|---|---|
| Developer name doesn't match the brand | Tap the developer name. Compare it with the company named on the provider's own website. | Copycats can borrow a famous logo and color scheme, but not the real company's developer account. |
| Generic keyword-stuffed name | Search the exact app name on the open web, outside the store. | Real VPN companies have a website, support pages and a company behind them. Names built from search terms often don't. |
| Missing or vague privacy policy | Open the policy link from the listing. Look for who runs the service, where it is based and what it logs. | A VPN that won't explain what it collects is asking for blind trust. |
| No company name or address anywhere | Check the website footer, terms of service and any “legal” or “imprint” page. | You need someone accountable for refunds, data requests and complaints. |
| Permissions unrelated to a VPN | Read the permission list and the store's data section. Watch for contacts, SMS, call logs, precise location or files. | A VPN needs network access. It does not need your text messages. |
| Reviews that all sound alike | Sort by most recent. Read the one- and two-star reviews. | Bursts of identical praise can be bought. Recent complaints about pop-up ads or surprise charges are more telling. |
| “Free, unlimited, no sign-up” with no paid plan | Look for how the company makes money. | Servers and bandwidth cost money. If you are not paying, something else is covering the bill. |
Red flags are signals, not proof. A small, honest developer can trip one of them. Several at once is a good reason to walk away.
How to check who really made the app
The single most useful check takes about two minutes. It works on both iPhone and Android.
- Start outside the app store. Type the provider's web address yourself instead of tapping an ad or a search result inside the store.
- Use the provider's own download link. Most providers link directly to their official App Store and Google Play listings. That lands you on the genuine page.
- Note the developer name on that listing. If you ever reinstall or recommend the app to someone, that name is what to match against.
- Look at the developer's other apps. A VPN publisher that also pushes dozens of unrelated cleaners, flashlights and wallpaper apps deserves caution.
- Read the privacy policy for specifics. You want a company name, a country, a plain list of what is logged, and whether anything is shared with third parties. Our no-logs explainer covers what to look for.
- Look for evidence from outside the company. Independent audits are the strongest signal. NordVPN's trust page, for example, says its no-logs policy has been independently verified five times since 2018. Surfshark's servers page points to no-logs reports by Deloitte from 2023 and 2025. Unknown apps rarely have anything comparable.
Search the app's exact name plus words like “malware,” “data leak” or “scam” in a regular search engine. Thirty seconds of reading can save you a headache.
Why “free unlimited” deserves extra suspicion
Running a VPN costs real money: servers, bandwidth, software development and support staff. A legitimate free VPN usually limits something, such as data, speed or locations, to nudge you toward a paid plan. That is an honest trade, and the company will usually spell out the limits.
An app that promises everything free, forever, with no paid tier has to cover its costs some other way. In-app advertising and data collection are the usual suspects. Our guide to how VPN companies make money breaks down the common models, and free vs paid VPNs covers what you give up on a free plan.
Ads inside a VPN app are a warning sign in themselves. Advertising code can collect information that the VPN's marketing promises to protect. Check the store's data section to see which data types the app says it collects, and what for.
None of this means every free VPN is fake. It means “free” should make you read the privacy policy more carefully, not less.
What the app stores give you to check
Both major app stores now show privacy information on each listing. They are useful, but they are not the same thing, and neither is a guarantee.
Data safety + security review badge
In November 2023, Google said VPN apps that pass an independent assessment under the App Defense Alliance's Mobile App Security Assessment (MASA) can show an “Independent security review” badge in the Data safety section. Google also began showing a banner when people search for VPN apps, linking to a directory of reviewed VPNs.
Google says the badge does not mean an app is free of vulnerabilities.
App Privacy details
Apple's privacy details come from what the developer enters in App Store Connect, including data collected by third-party code in the app. Apple says developers are responsible for keeping those answers accurate and up to date.
That makes the label useful for comparing apps, but it is still the developer's own description.
Use these tools as tiebreakers, not verdicts. A missing badge does not make an app dangerous, and a tidy privacy label does not make it honest. Combine them with the developer check above.
Install from the real provider
If you have already decided on a provider, the safest path is short. Here is a checklist you can run every time you set up a new phone, tablet or laptop.
- Type the address yourselfGo to the provider's website directly rather than through a store search or a social media ad.
- Use the official store linkFollow the provider's link to its App Store or Google Play listing. On a computer, download from the provider's own site.
- Match the developer nameConfirm the listing's developer is the company you meant to buy from.
- Read the first-launch promptsA request to add a VPN configuration is expected. Requests for contacts, SMS or photos are not.
- Pay through a channel you can traceBuy from the provider or the official app store so you have a receipt and a clear refund route. Our refund guide explains how each route works.
If you are leaning toward a big-name provider, start on its own site: NordVPN — see current pricing or Surfshark — see current pricing.
Some links on this page are affiliate links; we may earn a commission at no extra cost to you.
Already installed a risky VPN? Do this
Don't panic. Most of the risk stops the moment the app stops routing your traffic. Work through these steps in order.
- Disconnect and uninstall. Turn the VPN off inside the app, then delete it.
- Remove leftover VPN profiles. Open your phone's settings, find the VPN or device-management section and delete any profile the app added.
- Cancel any subscription. Check your App Store or Google Play subscriptions. Deleting an app does not always cancel billing.
- Change reused passwords. If you created an account with a password you use elsewhere, change it on those other sites.
- Update and scan. Install any pending system updates and run your device's built-in security check.
- Report the listing. Both stores let you report an app. It helps the next person.
- Reinstall carefully. If you still want a VPN, pick a provider using the checks above. For Android, our Android VPN guide is a starting point.
If you entered card details into an app you now distrust, contact your bank or card issuer and ask about the next steps.
Frequently asked questions
How can I tell if a VPN app is fake?
Compare the developer name on the store listing with the company named on the provider's own website, look for a real privacy policy and a company address, and be wary of permissions that have nothing to do with a VPN. The safest route is to start on the provider's website and follow its link to the app store.
Are free VPN apps always unsafe?
No. Some reputable providers run free tiers with clearly stated limits. The bigger risk is apps that promise unlimited free service with no paid plan and no explanation of how they make money, because the cost of running servers has to be covered somewhere.
What does the Independent security review badge on Google Play mean?
Google says it marks apps that completed an independent assessment under the App Defense Alliance's Mobile App Security Assessment (MASA). Google also says the badge does not mean an app is free of vulnerabilities, so treat it as one signal among several.
Is the App Privacy section on Apple's App Store verified?
Apple says developers provide that information in App Store Connect and are responsible for keeping it accurate and up to date. It is useful for comparing apps, but it is the developer's own description, not an audit.
I already installed a sketchy VPN. What should I do first?
Disconnect and uninstall it, delete any VPN profile it left in your settings, cancel any subscription through your app store account, and change any password you reused in the app. Then reinstall a VPN only from a provider you have checked.
Does a real VPN app make me anonymous?
No. Even a legitimate VPN only changes who can see your traffic in transit. Websites can still recognize you through logins, cookies and browser fingerprints, and the VPN company itself becomes the party you have to trust.
Sources
Pages below were opened and read on October 31, 2026, when this article was written. Policies and features change; confirm on the provider's site.
- Federal Trade Commission: FTC provides tips on using VPN apps The FTC's four checks: research the app, review permissions, confirm encryption, check third-party sharing.
- ICSI: Study finds many free Android VPN apps not secure 283 Android VPN-permission apps studied by CSIRO, ICSI, UC Berkeley and UNSW; 84% leaked traffic, 18% used no encryption; TLS interception and JavaScript injection.
- Google Online Security Blog: more ways for users to identify independently vetted apps Independent security review badge in the Data safety section, MASA, the VPN search banner, and the note that the badge doesn't mean an app has no vulnerabilities.
- Apple Developer: App privacy details on the App Store Privacy details are provided by the developer, who is responsible for keeping them accurate and up to date.
- NordVPN: Trust Center NordVPN's statement that its no-logs policy was independently verified in 2018 and four more times after that.
- Surfshark: VPN servers Surfshark's references to Deloitte no-logs reports from 2023 and 2025.
VPN Review is independent desk research. We read provider documentation, published audits, app store policies and third-party research; we do not run our own lab or test apps hands-on. Nothing here is legal advice. Features, prices and policies change, so confirm on the provider's site before you buy.