One tap on an APK file emptied his bank accounts. Google's 2027 change is meant to stop exactly this.
Key facts (Nov. 2026)
Google’s developer verification requires apps on certified Android phones to come from developers whose identity has been verified.
It started on Sept. 30, 2026 in Brazil, Indonesia, Singapore and Thailand, for apps from major app stores. Google plans a worldwide rollout in 2027.
Google found over 50 times more malware from apps downloaded off the internet than on Google Play.
Until it reaches you: install apps only from the Play Store, keep Play Protect on, and refuse unexpected SMS or accessibility permission requests.
I was in India recently, sorting out some personal matters. At the bank, I met a man whose life had just been turned upside down.
He'd tapped a link on Instagram. It downloaded an .apk file, and he installed it. Soon after, the savings in every one of his bank accounts were gone.
He isn't careless. He did what millions of people do every day: he trusted something on his phone that looked normal.
He's far from the only one, in India or anywhere else. In Karnataka, one Indian state, APK fraud cases nearly tripled from 2024 to 2025. Worldwide, Kaspersky counted 56% more attacks by Android banking trojans in 2025 than the year before. Google says apps downloaded from the internet carry over 50 times more malware than apps on Google Play, and in 2025 it found more than 27 million new malicious apps outside its store.
- 50×More malware from apps downloaded off the internet than on Google Play
- 27MNew malicious apps Google found outside Google Play in 2025
- 266MRisky install attempts Google Play Protect blocked in 2025
- 56%Rise in Android banking trojan attacks, 2024 to 2025
Sources: Google, Aug. 2025; Google, Feb. 2026; Kaspersky, March 2026
The fake apps pose as bank updates, traffic fines, bills and delivery alerts. Once installed, they can read your one-time passcodes and watch your screen.
Warnings help, but you can't expect every parent and first-time smartphone user to spot a perfect fake. The fix has to sit in the platform.
That's why Google's developer verification matters. On certified Android phones, every app, including ones installed from a file, will have to come from a developer whose identity has been verified. It started on Sept. 30 in Brazil, Indonesia, Singapore and Thailand, with apps from Google Play and other major app stores. Google plans to cover all apps worldwide in 2027. APK malware depends on staying anonymous, and verification takes that away.
How Google's developer verification rolls out
-
Aug. 2025 Google announces that apps on certified Android phones, including ones installed from outside its store, will have to come from verified developers.
-
June 2026 Android phones start getting the system check that confirms whether an app is registered to a verified developer.
-
Aug. 2026 An "advanced flow" launches worldwide, so experienced users can still install unverified apps, with extra safeguards.
-
Sept. 30, 2026 Brazil, Indonesia, Singapore and Thailand go first. Apps from participating stores, including Google Play, must come from verified developers.
-
2027 Planned Google plans to expand verification to all apps on certified Android phones worldwide.
Source: Google, Android developer verification guide (rollout timeline) and Android Developers Blog, Aug. 25, 2025
Apple has worked this way for years. Every iOS developer is identified, and apps are reviewed before they reach users. My team builds for both platforms, so I know the frustrations: reviews slow releases, rejections can feel strict, and there's extra admin. I've made those complaints myself.
But look at it from the user's side, over the long run. An iPhone user is very unlikely to lose their savings to an app file sent on WhatsApp. That trade-off has protected millions of people.
Google is now following, and it should. Power users keep an advanced option for installing unverified apps, so Android stays open. A bit of short-term friction for developers is a small price for stopping fraud that can wipe out a family's savings in minutes.
Until verification reaches your country, here's what I'd tell anyone at risk:
Install apps only from the Play Store, never from a link
Keep Google Play Protect switched on. In 2025 it blocked 266 million risky install attempts from browsers and messaging apps.
If an app suddenly asks for SMS, notification or accessibility access, say no
If money goes missing, call your bank straight away, then report it to your national cybercrime or fraud line. In India, that's 1930.
The man I met did nothing unusual. The platform let him down. In 2027, that starts to change.
Building Android apps for your customers or field teams? Talk to us about getting them verified and trusted before 2027.