Fake VPN App Scams
Bogus VPN apps that spy on your traffic, harvest credentials, or install malware instead of protecting you.
Last reviewed: 1 June 2026
What this scam is
Fake VPN app scams distribute malicious or deceptive applications that claim to offer virtual private network (VPN) protection — encrypting your internet traffic and masking your IP address — but in reality do none of these things, or actively do the opposite. Instead of protecting your traffic, a fake VPN may route it through an attacker-controlled server where it can be read, captured, or modified. Some fake VPNs install persistent malware, request excessive device permissions, or serve as a front for collecting and selling your browsing data.
VPNs have become widely understood as a privacy and security tool, and many people use them — particularly when travelling, on public Wi-Fi, or when accessing services from different regions. This legitimate demand has created fertile ground for fake and malicious versions, because users install a VPN specifically trusting it to handle all their traffic.
The threat comes in several forms. Some fake VPN apps are designed for financial fraud — they route the target's traffic through a server the scammer controls, harvesting login credentials as they pass. Others are commercial data-brokers in app form: they genuinely provide some VPN functionality but their primary purpose is to collect and sell your browsing history, search queries, and behaviour data. A third category includes VPN apps distributed as part of a broader scam, such as the apps used in investment or romance scams, where the VPN label provides a veneer of security legitimacy while the app performs other malicious functions.
The distribution methods mirror those of other fake apps: links in messages or emails, social media advertisements, app store listings near popular legitimate apps, and referrals from scam contacts who want you to install a specific app.
How it works
A scammer distributes a fake VPN through a convincing website, a social media advertisement, an app store listing, or a direct message. The app is described in terms that appeal to privacy-conscious users: 'military-grade encryption', 'zero logs', 'protect your identity online'. The design is professional and the download is often presented as free.
Once installed, several things may happen depending on the attacker's goal. In the data-interception variant, the app routes your internet traffic through an attacker-controlled server acting as the 'VPN endpoint'. All traffic visible to this server — which, for HTTP connections, means everything, and for HTTPS connections may include traffic subject to SSL stripping or certificate attacks — is readable by the attacker. Credentials entered into banking, email, and other services may be captured.
In the permissions-abuse variant, the app requests VPN permissions (which, on Android, grant the ability to capture all device network traffic) alongside other permissions such as contacts, storage, SMS access, and camera. The combination of VPN-level network access and these additional permissions creates a comprehensive surveillance capability.
In the malware-delivery variant, the VPN app installs a secondary payload in the background — a keylogger, a credential stealer, or a remote-access component — separately from the visible VPN interface, which may actually provide basic VPN functionality to reduce suspicion.
Some fake VPNs operate on a subscription basis, capturing payment card details in addition to traffic and device data.
Why this scam works
The irony of the fake VPN attack is that users install it specifically to protect themselves — which means they willingly grant it the broad network access it needs to do harm. VPN permissions on mobile devices are significant: when you install a VPN, you are explicitly giving it access to all your device's network traffic. A user who is privacy-aware enough to want a VPN may be less likely to scrutinise the specific VPN they choose, assuming that wanting privacy is enough to justify the trust.
A typical pattern
A person looking for a way to use streaming services from abroad searches for a free VPN and clicks the top result in their app store — an app with a name similar to a popular VPN and positive reviews. They install it, grant VPN permissions, and begin using it. Over the following weeks, the app routes their traffic through an overseas server the attacker controls. Their email and several financial accounts begin showing logins from overseas addresses they do not recognise. A review of the app reveals it was published by an unrelated developer with no privacy policy, and the app has since been removed from the store.
Common red flags
- Free VPN with no clear business model or company behind it
- App name similar to a popular VPN but with a different developer
- VPN recommended via a link, advertisement, or by an online contact
- App requesting permissions beyond VPN access — contacts, SMS, camera, storage
- No independently verifiable privacy policy or security audit
- App store listing with very recent creation date and no verifiable history
- VPN presented as part of another scam offer — an investment platform, a job app
- App that installs additional background processes or requests device administrator access
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
Protect your privacy with our free VPN — download now: [fake link].
Access any streaming service from anywhere. Install our VPN today: [fake link].
Stay safe on public Wi-Fi with military-grade encryption — free download: [fake link].
Our investment platform requires our secure VPN for access. Install here: [fake link].
Download our verified VPN to keep your connection private and secure: [fake link].
Free lifetime VPN — no subscriptions. Install from [fake link].
Common variations
- Free VPN data harvester — provides basic VPN function while selling browsing data
- Traffic-intercepting VPN — routes all traffic through an attacker-controlled server
- Investment scam VPN — distributed as part of a fake platform access requirement
- Impersonator app — near-identical name to a legitimate VPN with a different developer
- Malware bundler — installs keylogger or remote access alongside VPN interface
- Subscription card capture — fake VPN payment page harvests card details
How to verify before you act
Research any VPN before installing it. Look for independent security audits, published privacy policies (specifying that no logs of user activity are kept), and reviews from reputable technology publications — not app store ratings alone.
Be sceptical of free VPNs. Maintaining VPN infrastructure has real costs. A service that is entirely free either has a business model involving your data, or is straightforwardly malicious. Reputable VPNs have a cost or a credible freemium model.
Check the developer of any VPN app carefully. If an app in the store has a similar name to a well-known VPN but a different developer, it is an impersonator. Look up the company name independently and verify that the app store listing matches their official distribution.
Avoid installing VPNs recommended by strangers online, sent via links in messages, or promoted through pop-ups or social media advertisements. Navigate to the provider's official website and download from there.
Payment methods used
- Subscription card capture on malicious payment pages
- Downstream financial theft via harvested credentials
Who is usually targeted
- Privacy-conscious users seeking protection on public Wi-Fi
- Travellers and streamers looking for geo-unblocking tools
- Anyone directed to a VPN by a scam contact
What to do immediately
- Uninstall the suspicious VPN app immediately
- Change passwords for accounts you used while the VPN was active
- Review account activity for logins from unfamiliar locations
- Enable two-factor authentication on any affected accounts
- Review and revoke any unusual device permissions that the app held
- Run a security scan to check for any secondary malware the app may have installed
How to prevent it
- Research VPN providers independently before installing — look for published audits and reputable reviews
- Be sceptical of free VPNs with no verifiable business model
- Download VPNs from the provider's official website, not from links or app store search results alone
- Check the developer name matches the official company exactly
- Never install a VPN at a stranger's suggestion or via a link in a message
- Prefer VPNs from established providers with a track record and a published privacy policy
- Review the permissions an app requests before granting VPN access
- Uninstall VPN apps you no longer use — they retain access while installed
Evidence to preserve
- Name and developer of the VPN app
- Where you downloaded it from
- Permissions it requested and was granted
- Account activity showing unexpected logins
- Any subscription charge made to a payment card
Where to report it
- Action Fraud (UK) — UK national fraud & cybercrime reporting centre
- FTC ReportFraud (US) — US Federal Trade Commission fraud reports
- FBI IC3 (US) — US Internet Crime Complaint Center
- Scamwatch (Australia) — Australian competition & consumer reporting
- Your bank's fraud line — Use the number on the back of your card or in your banking app — never a number the caller gives you
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Frequently asked questions
Are all free VPNs unsafe?
Not all, but many free VPNs fund themselves by collecting and selling user data. Some are straightforwardly malicious. Reputable VPN providers typically have a cost or a clearly defined limited free tier. Always research a provider before granting them access to all your network traffic.
How can a VPN spy on me if it is supposed to encrypt my traffic?
A VPN encrypts traffic between your device and the VPN server — but the server itself sees all your decrypted traffic before it goes to the destination. A malicious VPN provider is the entity you are trusting with your decrypted data.
I gave VPN permissions to an app — what can it see?
A VPN app with network access can see the destination of all connections your device makes and the content of unencrypted traffic. It can intercept credentials on unencrypted sites and monitor your browsing behaviour comprehensively.
How do I choose a trustworthy VPN?
Look for independently audited providers with published no-log privacy policies, a verifiable company behind them, and positive reviews from reputable technology journalists. Avoid VPNs recommended via links, advertisements, or by strangers.
Can a fake VPN install malware on my device?
Yes. Some fake VPN apps bundle additional malicious components that run in the background. After uninstalling a suspicious VPN, run a full security scan to check for secondary payloads.
Is a VPN safe to use on public Wi-Fi?
A reputable, trustworthy VPN is one of the best protections on public Wi-Fi — it encrypts your traffic before it leaves your device. The key word is trustworthy: the VPN itself must be legitimate, not a fake installed to intercept the very traffic it claims to protect.
What should I do if I think my VPN was spying on me?
Uninstall it, change passwords for accounts used while connected, review account activity for suspicious logins, and run a security scan. Report the app to the app store and to your national consumer protection authority.