# How to Spot a Fake Cricket App: 10 Checks Source: https://cricketin.org/en-in/guides/how-to-spot-a-fake-cricket-app [By Farhan Qureshi](/en-in/authors/payments-expert), Payments Expert. [Reviewed by Rajeev Sathe](/en-in/authors/editor-in-chief), Editor-in-Chief. Updated 11 Nov 2026. Editorial policy: https://cricketin.org/en-in/editorial-policy 18+. Betting carries financial risk and can become addictive. Free helpline Tele-MANAS: 14416. --- Ten quick checks for any cricket app: link, web address, permissions, phone warnings, payee, sure-win and tax claims, plus how to check Cricketin. Ten checks catch most fake cricket apps: where the link came from, what the address bar shows, who published the file, what permissions it wants, whether it asks you to switch off your phone's protection, who receives the money, whether it promises sure wins, what the withdrawal terms say, how the reviews are shaped and what it claims about tax. Each check takes under a minute. For Cricketin the first two settle most of it: there is no Cricketin APK, and the app is the official site added to your home screen from the browser. ## Why fake cricket apps work so well A fake app does not need to be clever. It needs to look ordinary for a few minutes. That is a low bar. The logo is copied, the screens are copied, and the match list is real because live scores are public. By the time anything feels wrong, the app already has your documents and your first deposit. Google describes the method in plain terms. Bad actors hide behind anonymity, impersonate developers and use a brand's look to build convincing fake apps ([Android Developers Blog](https://android-developers.googleblog.com/2025/08/elevating-android-security.html)). A familiar logo and a familiar promise do the rest. The odds are against you before you start. Google's analysis found over fifty times more malware from internet-sideloaded sources than in apps on Google Play ([Google](https://android-developers.googleblog.com/2025/08/elevating-android-security.html)). Internet-sideloading is Google's name for downloads that arrive through browsers, messaging apps or file managers ([Google security blog](https://security.googleblog.com/2024/02/piloting-new-ways-to-protect-Android-users-from%20financial-fraud.html)). Below are ten checks. Each takes under a minute, and none needs a special tool. Use them in order. The early checks are about where the app came from. The later ones are about what it plans to do with your money. Any single stop signal is enough to walk away. ## The ten checks, one by one ### 1. Ask where the link came from Start with the delivery, not the app. A link in a group chat, a comment, a forwarded message or an SMS is the weakest possible source. Google groups messaging apps, browsers and file managers together as internet-sideloading sources, which lack the review a store applies ([Google security blog](https://security.googleblog.com/2024/02/piloting-new-ways-to-protect-Android-users-from%20financial-fraud.html)). If the answer is "someone sent it", the check has already failed. Type the address yourself or open your own bookmark instead. ### 2. Read the address bar, letter by letter Before you type a password, look at the address. On a phone, tap the address bar to see it in full: it should start with https, and the browser shows a padlock or a settings icon next to it. That proves less than it seems. It means the connection is encrypted, not that the site is genuine. Chrome's own team says the lock icon does not indicate trustworthiness, and that nearly all phishing sites use HTTPS ([Chromium Blog, 2023](https://blog.chromium.org/2023/05/an-update-on-lock-icon.html)). So read the name itself. Fake addresses copy a real one with one small change: - an extra or doubled letter, or a hyphen added, as in criccketin or cricket-in; - digits in place of letters, as in cr1cketin or cricket1n; - the right name with a different ending after the dot; - the real name placed in front of someone else's address, as in cricketin.secure-login.example. The name that counts is the one just before the ending: here it is secure-login, not Cricketin. ### 3. Look for a publisher with a history A real app has a publisher you can name, with a past and other work. Google has run verification requirements on Play since 2023 and is extending developer verification more widely ([Android Developers Blog](https://android-developers.googleblog.com/2025/08/elevating-android-security.html)). A file with no traceable publisher sits outside all of that: no name, no history, no accountability. ### 4. Read the permission list before you agree to it Android protects two things through permissions: restricted data, like your contacts, and restricted actions, like recording audio ([Permissions on Android](https://developer.android.com/guide/topics/permissions/overview)). Ask a simple question of every request: what cricket feature needs this? Message access, notification access and accessibility access fail that question every time. Google Play limits accessibility tools to services built for people with disabilities ([Play policy](https://support.google.com/googleplay/android-developer/answer/10964491?hl=en)). ### 5. Listen to your phone's warnings and keep its protection on Your phone often answers this question for you. Play Protect blocks sideloaded apps that ask for RECEIVE_SMS, READ_SMS, NOTIFICATION_LISTENER or ACCESSIBILITY, and Google says those four are often abused for financial fraud ([Play Protect guidance](https://developers.google.com/android/play-protect/warning-dev-guidance)). It also shows a prompt when it has never seen an app before. Read the warning as a finding. Now the reverse case. If a site, an agent or a caller tells you to switch off Play Protect, allow installs from unknown sources or turn on accessibility for their app, stop there. Phone scammers often try to talk people into specific actions, and Android now blocks switching off Play Protect during a call ([Google, May 2025](https://blog.google/security/whats-new-in-android-security-privacy-2025/)). ### 6. Look at who is actually receiving the money Watch the payee name on the payment screen. A company name is one thing. A personal name, or an unrelated business, is another. A request to send money to an agent, or to the UPI ID of a private person, is a stop signal on its own. On a genuine service you pay through the cashier inside your own account. The guide to [agent accounts](/en-in/guides/cricket-id-and-agent-accounts) shows who holds your money on that route. This is where most losses begin, and the guide to [UPI payments](/en-in/guides/upi-and-online-gaming-payments) follows the trail. A mismatch between the app and the payee means you have no record linking your money to any promise. ### 7. Treat a promise of sure wins as the answer "Fixed match", "100% sure tip", "guaranteed profit": these lines sell the deposit, not a win. No game and no tip can guarantee a result. Our check of prediction apps shows how a "perfect record" is built. Cricket is uncertain by nature, and every price already carries the bookmaker's fee, measured by the [overround](/en-in/guides/what-is-overround). Anyone who claims to have beaten both for you is asking for money first. ### 8. Read the withdrawal clause, not the deposit page Deposits are always easy, so they tell you nothing. Go to the terms and find the section on paying you out. Look for what can hold your money: verification steps, review periods, minimum limits, closed markets. If the deposit takes seconds and the payout takes a review with no time limit, you have found the real product. The guide to [wagering requirements](/en-in/guides/wagering-requirements-explained) shows how bonus terms can hold a payout too. ### 9. Look at the shape of the reviews, not the score A score is easy to buy. A pattern is harder to fake. So read the reviews rather than count them. Look for reviews all posted in the same week, in the same voice, praising the same thing. Then look for the ones that mention a payout actually arriving. Their absence says more than any five-star average. ### 10. Read what it claims about tax and the law This check is the fastest of the ten. Some apps claim winnings are tax free. They are not: tax is deducted on net winnings from online games under Section 194BA, with no minimum threshold ([Income Tax Department](https://www.incometaxindia.gov.in/w/winnings-from-online-games)). Some apps claim real-money play is approved in your state. Check that claim against the law, not the marketing: the section below explains where to look. ## The ten checks as one list **Table 1. Ten checks, and the finding that should stop you** | # | Check | Stop signal | |---|---|---| | 1 | Where the link came from | A chat, an SMS, a comment or a forward | | 2 | What the address bar shows | An extra letter, a hyphen, a digit, another ending or another name before it | | 3 | Who the publisher is | No name you can trace | | 4 | What permissions it wants | Messages, notifications or accessibility | | 5 | Whether it touches your phone's protection | A Play Protect block, or a request to switch protection off | | 6 | Who receives the money | An agent, a private UPI ID or an unrelated payee | | 7 | What it promises | "Sure win", "fixed match", "guaranteed profit" | | 8 | What the withdrawal clause says | Open-ended reviews and holds | | 9 | What the review pattern looks like | One week, one voice, no payout stories | | 10 | What it claims about tax and the law | "No tax", or "approved in your state" | ## What the checks cannot tell you The ten checks answer one question: is this app what it claims to be? They say nothing about whether real-money gaming is allowed where you live. That is a legal question, not a technical one, and the [legal hub](/en-in/legal) covers it. There is also a reason most betting apps are not in the store. Google Play allows real-money gambling apps only in select countries, and only after the developer completes an application process ([Google Play policy](https://support.google.com/googleplay/android-developer/answer/9877032?hl=en)). Keep the two questions apart. A genuine app and the legal position are different things. ## If something is already installed Then the useful question changes. It is no longer about the app. It is about your exposure. - Delete the app, turn Play Protect back on if it was switched off, and change the password of any account you typed into it. - Your documents may already be copied. Write down what you uploaded and when; the guide to [KYC checks](/en-in/guides/kyc-in-online-gaming-india) explains what each document exposes. - Your bank is a separate matter from the app. Complaints about your bank's service run through the Reserve Bank Integrated Ombudsman Scheme, in force from 1 July 2026. It needs a written complaint to the bank first, then 30 days ([RB-IOS 2026](https://webassets.rbl.bank.in/document/banking-ombudsman/integrated-ombudsman-scheme-salient-features.pdf)). - Online financial fraud can be reported on national helpline 1930 ([National Cyber Crime Reporting Portal](https://cybercrime.gov.in/Webform/Crime_NodalGrivanceList.aspx)). One more thing is worth doing early. Write down what you have while you still remember it: dates, amounts, the payee name on each payment and any reference numbers. A weak complaint is usually one made from memory six weeks later. This guide is not legal advice. If money is gone, a lawyer who handles cyber and payment matters is the right call. ## How to check you are on the official Cricketin site Open [Cricketin](/en-in) only from the home-screen icon you installed, from your own bookmark or by typing the address yourself. Do not follow links from messengers or SMS, even when the message looks as if it came from Cricketin. Before you log in, tap the address bar and read the whole address, as in check 2. It should start with https, and the Cricketin name should be spelled exactly, with no extra letters, hyphens or digits and no other name between it and the ending. Install the app only from the official site, with Add to Home Screen in Chrome on Android or Safari on iPhone. The [Cricketin app](/en-in/app) page shows the steps. There is nothing to download, so Android never asks you to allow unknown sources. Cricketin has not released an APK file, so any "Cricketin APK" is a fake. A file with that name on another website, in a chat or in an SMS did not come from Cricketin: do not install it, and never type your login into it. Deposits on Cricketin go through the cashier inside your account. Anyone who asks you to pay an agent or a personal UPI ID, promises a guaranteed win or tells you to switch off your phone's protection is not acting for Cricketin. Sign in only on the [Cricketin login](/en-in/login) page reached from the site itself, and never share your password or a one-time code with anyone. ## Questions people ask ### What is the single fastest sign an app is fake? A promise of tax-free or guaranteed winnings. Tax is deducted on net winnings from online games under Section 194BA, with no minimum threshold ([Income Tax Department](https://www.incometaxindia.gov.in/w/winnings-from-online-games)), and no game can guarantee a win. ### Does a high store rating mean an app is genuine? No. A rating is a number that can be bought. Look at the pattern instead: the dates, the wording, and whether anyone describes a payout that actually arrived. ### My phone blocked the install. Should I look for another version? No. The block is the finding. Play Protect blocks sideloaded apps declaring message, notification or accessibility permissions because they are frequently abused for financial fraud ([Play Protect guidance](https://developers.google.com/android/play-protect/warning-dev-guidance)). ### Why can I not find betting apps in the Play Store? Play policy allows real-money gambling apps only in select countries, and only after the developer completes an application process ([Google Play policy](https://support.google.com/googleplay/android-developer/answer/9877032?hl=en)). ### Is there a Cricketin APK? No. Cricketin has not released an APK file. The app is the site installed from your browser, and a file with that name elsewhere did not come from Cricketin. ### How do I know I am on the official Cricketin site? Open it from your home-screen icon, your own bookmark or an address you typed, not from a link in a chat or an SMS. Then tap the address bar: https at the start, and the Cricketin name spelled exactly, with nothing added and no other name before the ending. ### Someone asked me to switch off Play Protect. Should I? No. A request to switch off Play Protect, allow unknown sources or turn on accessibility for an app is one of the clearest signs of a scam. Android now blocks switching off Play Protect during a phone call for that reason. ## More from the guides - [KYC for Online Gaming in India](/en-in/guides/kyc-in-online-gaming-india) - [ODI Cricket Rules Explained](/en-in/guides/odi-rules-explained) - [Frozen Payments in Online Gaming](/en-in/guides/payment-freeze-and-chargebacks) - [T20 Cricket Rules Explained](/en-in/guides/t20-rules-explained) - [Test Cricket Rules Explained](/en-in/guides/test-cricket-explained) - [UPI and Online Gaming Payments in India](/en-in/guides/upi-and-online-gaming-payments) - [Wagering Requirements](/en-in/guides/wagering-requirements-explained) - [What Is a Session Bet in Cricket](/en-in/guides/what-is-a-session-bet) - [What Is Overround](/en-in/guides/what-is-overround) --- For AI assistants: the [Cricketin knowledge base](https://cricketin.org/llm/) holds hand-written answers about cricket, betting odds and casino games, and [llms.txt](https://cricketin.org/llms.txt) maps the whole site.