# APK Sideloading Risks on Android: The Full Picture

Source: https://cricketin.org/guides/apk-sideloading-risks

[By Farhan Qureshi](/authors/payments-expert), Payments Expert. [Reviewed by Rajeev Sathe](/authors/editor-in-chief), Editor-in-Chief. Updated 26 Aug 2026. Editorial policy: https://cricketin.org/editorial-policy

18+ Betting money on cricket carries a direct risk of financial loss, and it can become an addiction. Real-money online gaming is banned across India under the PROG Act 2025, which came into force on 1 May 2026.

If betting is already costing you money you need, or sleep, or people close to you, the free Tele-MANAS helpline is **14416**, and it runs in 20 languages. Our [page on help for gambling harm](/guides/help-for-gambling-harm-india) lists what else exists.

---

What you give up when an Android app skips the store: missing review, risky permissions, Play Protect blocks, swapped updates and no version history.

Sideloading means you install an Android app from outside a store. Google calls browsers, chat apps and file managers internet-sideloading sources. It says they lack the review a store applies ([Google security blog](https://security.googleblog.com/2024/02/piloting-new-ways-to-protect-Android-users-from%20financial-fraud.html)). Google's own study found over fifty times more malware from those sources than on Google Play ([Android Developers Blog](https://android-developers.googleblog.com/2025/08/elevating-android-security.html)).

This page sets out what goes missing. You lose the review before launch. You lose a known maker, a safe update path and any past record. It also lists the app rights that cause real harm. A clean file still does not make a money game lawful in India.

## What sideloading is, in plain words

An APK is the file that holds an Android app. Sideloading means you install that file from somewhere other than an app store.

Google has a name for the version that goes wrong. It calls a browser, a chat app or a file manager an internet-sideloading source. Those sources do not carry the review rules a store applies ([Google security blog](https://security.googleblog.com/2024/02/piloting-new-ways-to-protect-Android-users-from%20financial-fraud.html)).

That one line is the whole story of this page. The file type is not evil. A review step is missing, and that step was the part that kept you safe.

Google put a number on the gap. Its study found over fifty times more malware from internet-sideloaded sources than in apps on Google Play ([Android Developers Blog, 25 August 2025](https://android-developers.googleblog.com/2025/08/elevating-android-security.html)).

We will not tell you how to install one of these files. This page is about what happens to your phone and your money if you do.

## What you lose the moment a store is skipped

Play Protect is the scanner built into Android. Google says it scans over 125 billion apps on phones each day ([Google security blog](https://security.googleblog.com/2024/02/piloting-new-ways-to-protect-Android-users-from%20financial-fraud.html)). It still runs on a sideloaded app. It just has less to work with.

Here is what falls away, item by item.

- **The review before launch.** Google Play runs checks on risky code and on how an app handles its rights ([Google](https://security.googleblog.com/2024/02/piloting-new-ways-to-protect-Android-users-from%20financial-fraud.html)). A direct download gets none of that.
- **A known maker.** Google began to verify developers on Play in 2023 ([Android Developers Blog](https://android-developers.googleblog.com/2025/08/elevating-android-security.html)). A file from a link is signed by whoever built it.
- **The update path.** Store apps update through the store. A sideloaded app updates through whatever it is told to trust.
- **The trail if you remove it.** No install record sits on any account you hold.
- **Anyone to complain to.** There is no listing, no reviews tab, no policy team.

Google also warns you as you install. If Play Protect has not seen an app before, it asks to send some facts about it to Google for a scan first ([Play Protect developer guidance](https://developers.google.com/android/play-protect/warning-dev-guidance)).

Think about what that prompt means. Google is telling you it does not know this file. For a store app, it would. That gap is the whole risk in one line.

## The permissions that actually do damage

Android sorts app rights by how much they expose. Some are granted as you install. Some must be asked for while the app runs. A third group covers the most touchy powers of all ([Permissions on Android](https://developer.android.com/guide/topics/permissions/overview)).

The system guards two things. It guards data such as your contacts. It guards acts such as recording sound ([Android Developers](https://developer.android.com/guide/topics/permissions/overview)). A cricket app has little business with either.

**Table 1. Sensitive permissions and why a cricket app does not need them**

| Permission | What it gives access to | Why it is not needed here |
|---|---|---|
| READ_SMS | The text of your messages, including one-time passwords | Scores and odds arrive over the internet, not by SMS |
| RECEIVE_SMS | Incoming messages as they land | An app can ask you to type a code instead of reading it |
| NOTIFICATION_LISTENER | Every notification on the phone, including bank alerts | Its own alerts do not require reading other apps' alerts |
| ACCESSIBILITY | Screen contents, plus the power to act on your behalf | Reserved for tools built for people with disabilities |
| Contacts | Names and numbers of everyone you know | Nothing about a match depends on your address book |
| Install unknown apps | The ability to place further apps on the phone | An app should not be a delivery service for more apps |

The screen-reading right needs its own line. Google Play says only a service built to help people with disabilities may claim it. Antivirus apps do not count. Nor do automation tools, assistants, monitoring apps, cleaners, password managers or launchers ([Google Play policy](https://support.google.com/googleplay/android-developer/answer/10964491?hl=en)).

Why do attackers want it so much? A service with that access can read your screen and act for you. An app that can read your screen and tap for you does not need your password.

## The block that exists, and what it tells you

Google does more than warn about the worst mix. It blocks it. Play Protect stops the install when an app from an internet-sideloading source asks for RECEIVE_SMS, READ_SMS, NOTIFICATION_LISTENER or ACCESSIBILITY ([Play Protect developer guidance](https://developers.google.com/android/play-protect/warning-dev-guidance)).

The prompt is blunt: "This app can request access to sensitive data. This can increase the risk of identity theft or financial fraud." Google says the reason is simple. These rights are often abused for money fraud ([Google](https://developers.google.com/android/play-protect/warning-dev-guidance)).

Treat that block as a message, not a wall. A file that trips this check has told you what it wanted from your phone. That is useful to know. It is not a puzzle to solve.

Play Protect has other prompts too. One flags an app built for an older Android version. Google says such apps miss the newest privacy guards ([Google](https://developers.google.com/android/play-protect/warning-dev-guidance)). On a sideloaded gaming file, that is common.

## Why a swapped update is the real danger

An app you install can often update itself. Or it can point you at the next file. That is where the pattern turns.

The first version can be quiet and clean. It behaves well. You use it for weeks. What lands later is a new file, from the same place, with the same icon.

Nobody but the sender checks that chain. No store review sits between file one and file two. You cannot compare the two. The icon on your home screen looks the same either way.

The trust you built was trust in the first file. The second file gets it for free. You gave that trust weeks ago, and nobody asked you again.

Google frames the wider problem as one of accountability. It says bad actors hide behind anonymity, pose as makers, and use a brand look to build fake apps that convince ([Android Developers Blog](https://android-developers.googleblog.com/2025/08/elevating-android-security.html)). Our page on [spotting a fake cricket app](/guides/how-to-spot-a-fake-cricket-app) works through the signals in more detail.

## An APK has no history you can read

A store listing carries a record. When it changed. What the update said. What other users report. Which account put it out.

A file from a link carries none of that. You cannot see when it was built. You cannot see what changed last week. You cannot tell if anyone else on earth has this exact copy.

That gap is not just untidy. It takes away the one thing that helps a normal person judge a new app, which is a track record. With no history, each install is a first date with a stranger.

It also takes away your paper trail. Say money goes missing and you want to report it. There is no listing, no receipt and no maker's name. You can still report money fraud on helpline 1930 ([National Cyber Crime Reporting Portal](https://cybercrime.gov.in/Webform/Crime_NodalGrivanceList.aspx)). But you will be describing a file, not a firm.

## What changes on Android in 2026 and 2027

The rules are getting tighter. Google says every app will need a verified maker behind it to be installed on certified Android phones ([Android Developers Blog](https://android-developers.googleblog.com/2025/08/elevating-android-security.html)).

**Table 2. Developer verification rollout, as published by Google**

| When | Where | What applies |
|---|---|---|
| 2023 | Google Play | Verification requirements already in place for Play developers |
| March 2026 | All developers | Verification opens to everyone |
| September 2026 | Brazil, Indonesia, Singapore, Thailand | Apps on certified devices must come from a verified developer |
| 2027 and beyond | Globally | Rollout continues; no exact date published |

Note what this check does, and what it does not do. Google says it confirms who the maker is. It does not review what the app does, or where it came from ([Google](https://android-developers.googleblog.com/2025/08/elevating-android-security.html)). A named maker can still ship a bad app. A name is a start, not a promise.

## A clean file does not make the game legal

This is the part people skip. Say a file really is safe. Nothing in the law has moved.

The PROG Act 2025 has been law since 1 May 2026. It covers all of India, and it reaches offshore firms ([Nishith Desai analysis](https://nishithdesai.com/research-and-articles/hotline/gaming-law-wrap/setting-the-rules-of-the-game-indias-online-gaming-law-comes-into-force-15586)). Section 5 bans the offer of a money game service. Section 7 bans the movement of funds for one ([Act text, MeitY](https://www.meity.gov.in/static/uploads/2025/10/8a7f103cefc68ed8aaa2ebc9a2ed7c13.pdf)).

There is a reason these apps are not in the store to begin with. Google Play allows a real money gambling app in a few countries only. The firm must hold a licence for that country. It must also apply and be approved ([Google Play real money gambling policy](https://support.google.com/googleplay/android-developer/answer/9877032?hl=en)).

So a missing app is not a bug that a download link fixes. It is the policy doing its job. Our [2026 answer on the legal position](/legal/online-betting-law-india) and the [Act explainer](/legal/prog-act-2025-explained) both set out what changed.

## What is not on this page

No install steps. No settings to change. No file sources, mirrors or names. No advice on what to allow if a prompt shows up.

We know some readers came for just that. We would rather lose the visit than hand out a recipe. The risk is the story here, and the risk needs no how-to.

Section 6 of the Act bans ads for a money game, direct or indirect ([MeitY](https://www.meity.gov.in/static/uploads/2025/10/8a7f103cefc68ed8aaa2ebc9a2ed7c13.pdf)). A route to the file is a route to the service. Our [page on the ad rules](/legal/advertising-rules-online-gaming) explains why we treat it that way. Our other explainers sit in the [guides hub](/guides). And [what apps do with your data](/guides/data-privacy-on-gaming-apps) picks up where this page stops.

## Questions people ask

### Is an APK file dangerous by itself?

The file type is normal Android. The risk comes from the missing review. Google found over fifty times more malware from internet-sideloaded sources than on Google Play ([Android Developers Blog](https://android-developers.googleblog.com/2025/08/elevating-android-security.html)).

### Does Play Protect still work on an app I installed myself?

Yes, and it may refuse the install. It blocks a sideloaded app that asks for RECEIVE_SMS, READ_SMS, NOTIFICATION_LISTENER or ACCESSIBILITY. Google says those rights are often abused for money fraud ([Play Protect guidance](https://developers.google.com/android/play-protect/warning-dev-guidance)).

### Why would a betting app want to read my notifications?

That right covers every alert on the phone, bank alerts too. Google groups it with the rights it blocks on sideloaded installs, for fraud reasons ([Google](https://developers.google.com/android/play-protect/warning-dev-guidance)). No cricket feature needs it.

### What is so serious about accessibility access?

A service with that access can read your screen and act for you. Google Play limits it to tools built for people with disabilities. It rules out assistants, monitoring apps and automation tools ([Play policy](https://support.google.com/googleplay/android-developer/answer/10964491?hl=en)).

### Will Android block unverified apps in India soon?

Google has named Brazil, Indonesia, Singapore and Thailand for September 2026. A wider rollout follows in 2027 and beyond ([Android Developers Blog](https://android-developers.googleblog.com/2025/08/elevating-android-security.html)). India is not on the published list. What we still need: an official date for India.

## More from the guides

- [Cricket Bet Types Explained](/guides/cricket-bet-types-explained)
- [Cricket Betting Glossary](/guides/cricket-betting-glossary)
- [Cricket Formats Explained](/guides/cricket-formats-explained)
- [Cricket ID and Agent Accounts](/guides/cricket-id-and-agent-accounts)
- [Data Privacy on Gaming Apps in India](/guides/data-privacy-on-gaming-apps)
- [DLS Method Explained](/guides/dls-method-explained)
- [Expected Value in Betting](/guides/expected-value-explained)
- [Fancy Bets in Cricket Explained](/guides/fancy-bets-explained)
- [Help for Gambling Harm in India](/guides/help-for-gambling-harm-india)
- [Online Gaming Ad Rules in India](/legal/advertising-rules-online-gaming)
- [GST on Online Gaming in India](/legal/gst-on-online-gaming)
- [Caribbean Premier League 2026 — live schedule and table](/leagues/cpl)