You no longer have to go to a bank to make a payment, thanks to fintech apps like Venmo and PayPal. Seemingly inspired by these apps, the internet is now filled with dangerous SpyLoan apps that pretend to be there to loan you money but have ulterior motives.

Cybersecurity company ESET’s researchers have discovered that such loan apps are on the rise. These apps target vulnerable people in Southeast Asia, Africa, and Latin America in need of urgent money. Often, these victims can’t access established financial assistance channels.

In 2022, both Google and Apple removed several SpyLoan apps from their stores. They are also spread through third-party stores and websites.

18 more apps made their way to Google Play this year and 17 of them were downloaded 12 million times before being removed. One app remains available because its developers changed how it works so it’s no longer considered harmful.The perpetrators market the apps through social media platforms such as Twitter (X), Facebook, and YouTube, and text messages.

SpyLoan apps promise instant loan but charge an unusually high interest rate and expect quick repayment

The apps promise swift financial assistance and use deceptive techniques to get approved on Google Play. To look authentic, they pretend to be closely affiliated with well-known loan providers and financial institutions or are designed to resemble legitimate loan apps. Some even have official websites with a fake board of directors with stock photos and images of office space lifted from other websites.

After a SpyLoan app is downloaded, it asks the user to accept the terms of service, grant various permissions including access to call logs, storage, media files, contact lists, and location data, and provide personal details such as address, contact information, bank account information, and photo of the identification card.Once the people behind the apps gain access to all this user information, they start blackmailing the victims to repay them even if a user never applied for a loan or their loan wasn’t approved.

They don’t follow Google’s policies, which set a cap on interest rates and a repayment tenure of more than 60 days. For instance, in one case, someone asked for 450 pesos and was expected to return it within 5 days along with the interest amount of 549 pesos.

If someone refuses to comply, they are threatened with dire consequences, including death.

Here are the names of the apps:

If you have already downloaded any of the apps mentioned above, delete them immediately. If someone is getting harassed, they should get in touch with law enforcement authorities. To stay safe, only download apps from trusted sources and go through reviews and ratings before installing an app.