To verify that a wallet download is real, never start from a search result, an ad or a link someone sent you: type the wallet's official domain yourself, follow the store links from that page, and confirm the publisher name and listing history match before you install. For WATS, the only genuine source is the official WATS download page, which links to one listing per store for the Chrome Extension and the mobile app. The tell that exposes almost every fake is the same everywhere: a legitimate wallet asks for an existing recovery phrase only when you deliberately choose to restore one — never to “validate,” “sync” or “unlock” anything. WATS is fully non-custodial, meaning you hold the keys and WATS never holds a key, so there is no WATS screen that needs your seed phrase to verify you. If an app, a popup or an “update” page asks for those words, it is not the wallet it claims to be.
The one rule that beats almost every fake
A fake wallet app is not sophisticated malware. It is a copy of a real wallet's name, icon and screenshots wrapped around one goal: getting you to type your recovery phrase into a screen the attacker controls. That simplicity is why fakes keep working — and why the defense is a handful of habits, not a security degree. Control where you start (the official domain), check who published the listing, and refuse every request for your seed phrase that you did not initiate yourself.
How do fake wallet apps actually steal your crypto?
They ask. Somewhere in the flow — an “import wallet” step, a “validate your wallet” screen, a “sync your account” prompt — the app shows the familiar 12- or 24-word entry grid. The moment you fill it in, the words are sent to the operator, and whoever holds a recovery phrase controls every account derived from it. Draining is typically automated and takes minutes, not days.
Some fakes are even patient. Because balances are public blockchain data, a clone can behave like a working wallet — showing your real holdings — while the operator waits for the balance to grow before sweeping it. Working normally is not proof an app is genuine.
Can fake apps really get into official app stores?
Yes, and they repeatedly have. Store review is built to catch malicious code behavior, and a fake wallet often contains none — technically it is just an app with a text form. Impersonating a specific brand is a policy violation that mostly gets caught after user reports, which is why clones follow a cycle: appear, harvest, get removed, reappear under a new developer account. The result is a cat-and-mouse game that keeps repeating in both major mobile stores.
Search ads are the second front. The paid slots above organic results have repeatedly been bought by phishing sites dressed as wallet download pages — same logo, lookalike domain, working buttons. An ad's position is rented, not earned; treat it as untrusted by default.
What about browser extensions and fake “updates”?
Extension stores have the same clone problem, with an extra twist: popups and websites claiming your wallet extension “needs an update,” your “session expired” or your wallet must be “re-validated.” Every one of those roads leads to the same place — a page asking for your seed phrase. Real extensions update silently through the browser; no legitimate update ever requires re-entering a recovery phrase.
There is also a quieter risk: extensions changing hands. A legitimate tool can be sold, or its developer account compromised, and a later update turns hostile. Keeping your extension count low and your habits tight — covered in crypto wallet security best practices — limits the blast radius.
How do you verify a real wallet download?
- Start from the official domain. Type it yourself or use a bookmark you made earlier — not a search ad, not a DM, not a QR code in a reply. For WATS, that is the official download page.
- Follow the store links from that page. The official site links to exactly one listing per store; that link is your source of truth.
- Check the developer name. The publisher on the listing must match the company exactly — clones use lookalikes, misspellings or generic studio names.
- Read the listing's history. An established wallet has years of reviews — and on Google Play, a large install count; a “popular wallet” whose listing appeared last month with only a handful of reviews is a red flag, whatever its star rating.
- For extensions, verify the exact listing. Install only through the link on the official site, and check the developer field again after installing.
The same evidence-first habit applies to product claims, not just downloads — the questions in how to judge whether a specific wallet is safe are worth asking of every wallet, including the one you already use.
Real listing vs clone: the tells
| Signal | Real wallet | Fake wallet |
|---|---|---|
| How you found it | Official domain, then its store link | Ad, DM, search result, social reply |
| Developer name | Matches the company exactly | Lookalike, misspelling or generic studio |
| Listing history | Years of reviews, consistent updates (on Android, a high install count) | New listing, few reviews, cloned screenshots |
| Seed phrase | Asked only when you choose to restore | Demanded to “validate,” “sync” or “update” |
| Updates | Silent, through the store or browser | Popups and external “update” pages |
What if you typed your seed into a fake app?
Assume the phrase is compromised the moment it left your keyboard — there is no undo, and drainer scripts act fast. Speed now matters more than certainty.
- Create a fresh wallet with a brand-new recovery phrase on a verified download — the process in how to set up a crypto wallet takes minutes.
- Move funds immediately, highest value first: native coins, then major tokens, then the rest. Expect to be racing an automated script, not a person.
- Never reuse the exposed phrase. Every address it can derive is permanently burned, even the empty ones — anything sent to them later is exposed too.
- Report the fake to the store and to the wallet team it impersonates — takedowns protect the next person.
How WATS fits in
WATS is fully non-custodial across all four of its products — the Chrome Extension, the mobile app, the Hot Wallet and the NFC Metal Card. You hold the keys and WATS never holds a key, so no genuine WATS build has any reason to ask for an existing recovery phrase to “validate,” “sync” or “unlock” an account. There is exactly one moment a WATS app asks for a phrase: when you deliberately choose to restore a wallet you already own. Anything else wearing the WATS name is a fake, no matter how convincing the icon is.
One WATS-specific point is worth stating plainly, because counterfeit hardware plays on the confusion: the WATS NFC Metal Card does not store private keys or a seed phrase. It tap-authenticates to keys that stay inside the WATS apps, using a unique card ID that pairs to exactly one device. So a genuine WATS card never arrives with a recovery phrase already inside it — treat any “wallet card” that ships pre-loaded with words as compromised, whatever brand is stamped on it.
The practical step is small and you only have to do it once. Install WATS from the official download page — never from an ad, a search result, a DM or a QR code in a reply — confirm the publisher name on the store listing before you install, and bookmark that page so every future install and update starts from a link you already trusted. Then write down the recovery phrase WATS generates, keep it offline, and treat any screen that later asks for it back as an attack.
Frequently asked questions
How can I tell if a wallet app is fake?
Check three things before installing: where you found it, who published it, and what it asks for. A real wallet is reached from its official domain, its store listing shows the company's exact developer name with a long review and install history, and it only asks for a recovery phrase when you deliberately choose to restore one. An app that demands your seed phrase to “validate,” “sync” or “update” is fake — close it.
How do I know I am downloading the real WATS wallet?
Install WATS only from the official WATS download page, which links to the one genuine store listing for the Chrome Extension and the mobile app, and check that the publisher name on that listing matches before you install. WATS is fully non-custodial — you hold the keys and WATS never holds a key — so no genuine WATS build asks for an existing recovery phrase to “validate,” “sync” or “unlock” anything; it asks only when you deliberately choose to restore a wallet. If you reached a “WATS” download through an ad, a DM or a search result, close it and start again from the official site.
Can fake wallet apps get into the App Store or Google Play?
Yes — clones of popular wallets have repeatedly appeared in both major stores, and new ones keep surfacing. Store review is designed to catch malicious code, but a fake wallet is often just a form that collects seed phrases, so impersonation is usually removed only after user reports. The cycle repeats under new developer accounts, which is why the official website — not store search — should be your starting point.
Does the WATS NFC Metal Card protect me from fake wallet apps?
Not on its own, and it is worth knowing why. The WATS NFC Metal Card does not store private keys or a seed phrase — it tap-authenticates to keys that live inside the WATS apps, using a unique card ID paired to exactly one device. That means a genuine WATS card never ships with a recovery phrase already inside it, so any “wallet card” that arrives pre-loaded with words should be treated as compromised. It also means an exposed seed phrase drains a wallet whether or not a card exists, so refusing every unsolicited request for those words is still the real defense.
What should I do if I entered my seed phrase into a fake app?
Treat the phrase as stolen immediately — draining is usually automated and fast. Set up a new wallet with a freshly generated recovery phrase on a verified download, then transfer everything to it, highest-value assets first. Never reuse the exposed phrase or send funds back to any address it derives; those accounts are permanently compromised even if they look untouched. Finally, report the fake app to the store to help others.