Is it safe to download an app a stranger sends me a link to?
You should never install an app from a link sent by someone you do not know. Legitimate apps are distributed through official app stores, and direct installation links almost always lead to malware.
Last reviewed: 10 June 2026
Explanation
Mobile malware is most commonly distributed through direct download links ('sideloading') sent via messaging apps, social media, SMS, or email. Because these apps bypass the app store review process, there is no screening for malicious code. The same remote-access tools, banking trojans, and spyware that appear in tech-support scams are frequently delivered this way.
The context varies. A new contact on a dating app might claim to be sharing a 'special platform' for investment trading. A messaging scam might claim a link leads to a video featuring you. A fake parcel notification might say you need a specific delivery app. In each case, the file you install is not what it claims to be.
On Android devices, installing apps from outside the Play Store requires enabling 'Unknown Sources' or 'Install unknown apps' in settings — a deliberate security barrier that warns you of the risk. On iOS, sideloading is more restricted but possible through enterprise certificate abuse or configuration profiles. Receiving a request that involves changing your device's security settings to install an app should be treated as an immediate stop sign.
If a service genuinely uses an app, it will be available in the Google Play Store or Apple App Store. Search for it there by name. If it does not appear in official stores, it should not be installed on your device.
Common red flags
- A stranger sends you a direct link to download an app rather than referring you to an official store
- The installation process requires you to enable 'Unknown Sources' or change security settings
- The app claims to be an investment platform, special messaging app, or exclusive trading tool
- Installing a profile or certificate on iOS is requested
- The app is described as an upgraded or exclusive version of a well-known service
- The app requests accessibility permissions, device administration rights, or VPN configuration
What to do now
- Do not install the app and delete the link message
- If you have already installed it, uninstall it immediately
- Run a reputable mobile security scan after uninstalling
- Check your banking and financial apps for unexpected changes or new payee additions
- Review which permissions the app had — if accessibility or device administrator permissions were granted, consider a factory reset after backing up data
- Report the sender to the platform and to your national cybercrime reporting centre
Frequently asked questions
The app looks like a real trading platform — could it be legitimate?
Pig-butchering and investment scams use convincing fake trading platforms that show real-looking balances and profits. The functionality is designed to build trust before a withdrawal request reveals the fraud. If it is not in an official app store, do not use it.
I installed it but it seems to do nothing — is it still dangerous?
Some malware is deliberately invisible to avoid prompting removal. It may run in the background logging keystrokes, reading SMS messages (including 2FA codes), or monitoring screen content. Uninstall it and run a security scan regardless of observed behaviour.