Scammed by the top result for 'Bitcoin wallet' in Apple App Store

> scammy ads plastered everywhere is what I'd expect from Google products

This won’t fit with the manufactured popular understanding, but at the current time, Google protects you from fraud and scam better than anyone.

I have been unfortunate enough to be scammed recently from a bing search result (ad). (It was a new computer and I decided to use Edge and bing was the default search).

Apple, Microsoft etc. are rookies in this game. Google just has the benefit of experience and hence is much safer now than anyone can ever become in the near future. Because of this, scammers are much more likely to target other platforms… which happen to be Apple, Bing, Facebook etc.

On the contrary, as someone who has worked with both platforms as a developer, this is my personal opinion:

- Around a lot of things software, including the Play Store, Google’s safety and security, for all its ads, tracking and shenanigans, are real, largely verifiable, discussed openly, and pretty fucking robust (not to mention, most of it are actually open).

- Apple’s? Smoke and mirrors! Essentially some vague shit which often ludicrously boils down to Safest Shit Ever On an iPhone™ (and doesn’t go further than that) and never discussed or even offered a glimpse of.

Hilarious. I don't think i have never seen or gotten a scam app (not including games, which I don't use) as the top result on Google Play.

In fact, I just used all your searches on Google play and got

- my bank

- the train company app

- my broker

- hmrc

The next 4 or 5 in each case were also legit. Maybe this is really something to be aware of if switching to apple? Certainly would not have been something I would have been expecting from apple (though I am pretty careful about vetting apps).

I am still surprised that when I search for a specific app (as you did for your bank) I still see junk ads before the real app shows up. Apple should be better than that. They seem to have the same bad incentive Google search does.

What is CFD gambling? When I read “CFD” I always think of computational fluid dynamics and so “CFD gambling” sounds pretty cool to me. Obviously I do know I’m just overfitting to a TLA and I’d like to know what it actually means.

In hindsight, this is quite obvious. Coming from years of using Google Pixels I just got used to trusting the search results. I've never hit a fraudulent app when searching in the Play Store. I trusted apple that at least the top 5 results would be legit. EDIT: added the word 'top' at the end

When I first got an iPhone a few years back, this is the thing that shocked me most. This is completely out of line with what I expect from Apple. I don’t have "scams" per se, but the first result when searching for a keyword is systematically an ad for a competitor:

- Spotify -> Deezer

- Uber -> Heetch

- UberEats -> Deliveroo

- Deliveroo -> Ubereats

- My bank -> crypto.com

I have no idea why Apple allows buying trademarks/full app names as an ad keyword. Perfect matches should always have the app first, not an ad.

Is there something in the AppStore rules that prevent apps from buying the keyword ad for their own app?

Especially given they use enhanced security as an excuse so often

Special mention, the f***ton of Whatsapp clients on the iPad when Whatsapp didn't have any releases for the iPadOS up until last September.

This has been a very noticeable problem to me for some time.

I won't search the App Store anymore. I go to the web site for the app I want and get the App Store link that way.

I wish the App Store listings would specify the domain of the entity they come from in plain text, backed by a validation method similar to what we do for TLS certs.

Can you share some search terms you tried? I never had this problem, but I’m also not in the US so it might be different here

I don't recognize this picture at all. Even if you aren't distinguishing between ads and search results I'm not seeing scams as adverts but there may be a difference between the UK and US app stores in this respect perhaps.

For me on apple UK app store:

my bank - Ad: another legit bank. First result: my bank

Train company - Ad: a generic legit train booking app. First result: the train company

My broker - Ad: another broker. First result: my broker

Official government app for paying my tax - ad: a general tax app. First result: government app.

It stands to reason that they won't show an ad for the thing you're searching when it's the first organic result so I don't find this surprising.

[1] I have two and tried both. Results were the same with a different legit bank as the ad each time.

Do you mean the search result or the ad that pops in at the first space? For me all those have good results but all contain ads for more or less unrelated apps

I would also expect products with premium pricing to not contain ads.

> my broker? CFD gambling app

I don't think 'gambling app' is a fair description given it's a regulated security, any broker that truly offers CFD trading is (1) going to be legit; (2) going to be competing with the broker you were searching for for result space.

Of course to serve its users any app store should massively prioritise the word/brand (incl. typos) you actually search for though.

> I don't think I've ever searched for something on the app store and not got a scam as the first result

It’s cool to crap on Apple and all these days but this is all categorically false. What you are referring to is the Ad on the top of the page. It’s clearly labeled as ad and has a light blue box around the whole ad.

I tried all those things you mentioned and the first result after the clearly labeled ad is what I searched for.

TFA is talking about a literal scam, where his money vanished.

> - my bank? I get crypto.com

Although crypto.com is not a bank, they seem like a legit business and not a scam. Many people are using crypto.com: I know one person who has one such card and I asked a waiter if he had already seen cards like that (waiters gets to see many credit/debit cards a day) and he answered me that they weren't that uncommon.

> - official government app for paying my tax? intuit product

They may be using shady tactics but they are not a scam.

Also from Schiller.. the open web is a direct threat to our cash cow.

https://files.mastodon.social/media_attachments/files/111/95...

The company that claims to have "the highest standard everywhere in the world" for security and privacy, happens to run a major desktop platform (macOS) with only a primitive basic signature-based antivirus built-in. Instead they rely on Gatekeeper/notarization for the bulk of the protection, which is a pain for devs (when it doesn't work right) and less effective.

Same is now happening with iOS sideloading, instead of robust antimalware based on heuristics and app behavior (like Google Play Protect), they'll keep relying on blunt instruments like notarization. Doubt it'll keep users safer. Maybe it's NIH syndrome?

Apples app store is way worse than the google play store. i was shocked at how bad the app store is with shitty ads and promoted content over organic search results

fwiw i hope yall get approved. thank you & take care.

It did - before cheapo enshittification started creeping in. I believe some time ago I saw some research on the quality of App Store app review process … zero protection.

But, even at this stage, Apple is still “the best”, because of the slower pace of the corruption and in comparison to the toxic dumpster fire of the alternatives.

Android and Windows are spyware/malware masquerading as OSs.

and in this scenario, Apple has no incentive to stamp this out as they make money either way.

That’s insane, and news worthy. Imagine non-techies just trying to go about their day and getting that.

But hold on a sec. Is this verified by others? The guy in the video cuts to a screenshot, which doesn’t show the resulting url or how he got there, so it’s hard to tell what happened.

This is about app stores, not web searches. Google Play Store does not suffer from this issue to the same degree at all.

>Google even vouches for the advertiser

Google vouches that the advertisers is who is he says he is. Google is not vouching for the reputation if the advertiser.

It wasn't a promoted result, it's an organic search result, and it's still there!

You're right, I shouldn't trust a random app. Also, it's pretty much my first serious foray into Apple land. I trusted Apple's search results. There are multiple apps, far more mature and backed by serious developers, that would also match the phrase "Bitcoin Wallet".

The question is why is the scam app the #1 organic search result? For a new app with such scammy reviews and questionable metadata I would expect it to be #30 in the list. For context, the app store reports the scam app as #85 in all finance apps.

> But I don't really understand why you'd blindly trust some random app?

Perhaps because Apple claims their apps go through a review process, and one would hope this would have failed that process? That's what Apple claims the value proposition of their 30% cut and closed platform are.

Same for me, second result. I've never had anything crypto-related on my phone.

Security isn't binary and it should be compared relative to other platforms.

To cut Apple in all transactions, and maximize grift by having just scam apps

Steve Jobs saw what Steve Case had with AOL and thought "we need to be doing that".

Honestly, I got lazy, and that's on me. I was using the standard bitcoin wallet app on android. It did seem weird I can't restore the wallet I backed up in the android app, but the android app github doesn't point to an app store app, so I figured there just isn't and the android app's backup format is something detached.

Then I figured a legit apple app could generate a wallet and I could transfer the bitcoin between them. Which is what I did. The apple app indeed received it and promptly sent it off somewhere else. What's even crazier is that the apple app shows this info! You'd expect the scammer to hide the scam but I suppose it just made it easier to pass the app store inspection.

> You can't escape personal due diligence and "it was top ranked!" has never been that.

Apple continually makes claims that the closed ecosystem is essential to the safety of their customers, that they have a robust review process, and that their customers choose them because of the safety they provide. Apple should stop repeating these claims if they are not, in fact, reliable protection against scams.

Posted above the screen recording: https://streamable.com/y5nhy7

> You can't escape personal due diligence and "it was top ranked!" has never been that.

On one hand that's a fair point and I should've known better. OTOH I think it is legit to trust top app store search results to return quality apps, especially if there is a massive disparity between their quality. The scam app has obvious repetitive spam reviews. The developer's website is terrible and the submit button doesn't even work. This is basic quality control on apple's part. If every single app store user needs to manually vet every single app they install to the proper extent there would be a fraction of a fraction of the installs and respectively, a fraction of a fraction of the revenue.

Consider the extent of lawsuits between apple and companies with app store apps - does it not strike you that apple protects that revenue stream? Wouldn't it make sense to give app store users a sense of trust in the top search results?

> Mistake #1 : switching to an even more closed computing environment, where user has strictly no control

I've been with Google Nexus and Pixels for many years, roughly starting with the Nexus One. Ironically, I switched from an iphone 3GS at the time that I owned for a few months.

After many years of being on windows, then linux, then Mac, then back to linux, now back to Mac with linux on ssh, my conclusion is that user control doesn't necessarily mean a better user experience. A closed computing environment allows for consistency and sturdiness. When you start looking at your phone as a device, rather than as a computer, it becomes obvious.

> Mistake #2 : running on a tech. stack you do not control: closed-source, walled-garden

I don't control android in any way. I could read its source code if I really, really wanted to but why would I? I want a product. A device. Would you read the source code of your washing machine? Dish washer? At some point you want to live your life and stop reading anything and everything as if you actually have enough time to tinker with all of it.

> Mistake #3 : using a wallet instead of your own private cold storage to hold any kind of significant amounts of money

Meh. 'Significant amounts of money' is subjective. Some would say the amount of money I lost would be a life changer, some would shrug it off as a yearly bonus on the lower end of the scale. Fact is, I had my bitcoin on some version of a pixel for roughly 7 years and never had a problem.

> Mistake #4 : trusting that Apple is making huge efforts to secure their environment.

They made a huge effort to secure their hardware; its some of the best in the world. The thing is they put a ton of focus on hardware security but hardly enough on software / service stuff. In this case, the app store search was compromised by some bots leaving reviews.

Your general theme seems to rely on having access to open source on all levels leads to more security.

This is patently false. For example, the vast majority of smartphones use baseband processors that are not just closed source with closed source drivers, but the ICs themselves are tightly guarded secrets by their manufacturer (probably Qualcomm). There are probably a dozen or so chips in every smartphone running all sorts of firmware you have no access to. Same goes for computers.

In fact, I would argue that Apple's model might be the most secure, because they do SoC, which requires they know far more about and have much more control over the inner workings of every sub component.

Here is a screen recording including this hacker news post + your comment & and a switch to the app store with the search phrase. The first result is the scam app. I scrolled down so you can see where serious apps are in the list of results. https://streamable.com/q2mulu

I just took a screenshot of the app store about an hour ago: https://pasteboard.co/bZ7qQvAzYggy.png

Any idea where they’re based? Are they global? They do my reviews at weird times.

Yes, but how does following the tx trail help me in any way? They've moved the BTC a few times since the wallet sent it to them.

When I installed it, it was the #1 organic search result. Other commenters report seeing the same app as #2 organic search result.

Just because an account is newly created does not make their first post FUD. Their story is precisely what happened to me, although for a slightly smaller amount of money.

>do people really just click the first thing they see?

It's just people behaving in a certain way, and that being exploited. If people had a different behavior, the exploit would be different too.

I didn’t put a seed phrase into the app. I created a new wallet in it and transferred the btc to it.

You're right, and I've done both. My review doesn't appear in the list of reviews.

What's crazy is that a scam app is the #1 organic search result for 'bitcoin wallet', above blockchain.com and coinbase.

> …nor can you report it to Apple from within the App Store.

You can, since 2021. https://www.theverge.com/2021/10/4/22705405/apple-report-a-p...