How to Find Out Who Owns a Suspicious App

Both Apple’s App Store and Google Play require a developer to publish a name, a support contact, a privacy-policy link, and, for many account types, a verified physical address and a “data safety” or privacy summary. Start there. Tap the developer name to see every other app on that account; a legitimate software company has a coherent catalog, while a harvesting or fraud operation often has a graveyard of unrelated, low-effort apps published under one shell. Note the website and support email exactly, because they are your bridge to the next layers. Capture the data-safety section that lists what the app says it collects and shares, and compare it to the permissions the app actually requests on your device. A wide gap between what the app claims to collect and what it demands access to is itself evidence.

Then open the privacy policy and read past the legal boilerplate for two things: the name of the company or “data controller” and a real, physical mailing address. This is frequently the single place an anonymous-looking app names its actual operator, because privacy law in many places requires it. If the policy is missing, links to a dead page, is copied word-for-word from another app, or names no entity at all, treat that as a serious strike. Save the policy as it exists today, since these pages are quietly edited or deleted once an app draws scrutiny.

Once you have a legal entity name from the privacy policy or an unmasked WHOIS record, take it to the public business registries. In the United States, every state’s Secretary of State maintains a free, searchable database of registered companies, and a search there can return the entity’s status, its formation date, its principal address, the names of its officers or members, and the registered agent, which is the real person or service legally designated to receive legal mail on the company’s behalf. The registered agent is often the most reliable bridge from an anonymous app to a contactable human. If the company claims to be foreign, most countries run an equivalent companies register you can search the same way.

What you find, and do not find, both mean something. A clean filing with consistent officers and an address that matches the privacy policy points to a real, if perhaps careless, business. An entity that does not exist in any registry, was dissolved years ago, or lists a mass-registration address shared by hundreds of shells is a strong fraud signal. From a verified name and address, the lawful research continues into the kind of public-records and address-confirmation work that establishes where a real person can actually be reached, which is what any report, demand letter, or civil claim ultimately needs.

Whatever you uncover, reporting is not optional, because your single report is what lets investigators connect one bad app to the many people it touched. Report the app to the store first: both Apple and Google have a built-in “report a problem” path, and a flagged app can be pulled, which protects the next person even if it does nothing for you directly. File with the FTC at reportfraud.ftc.gov, the federal government’s central intake for fraud and deceptive apps, and read the practical guidance at the FTC’s consumer site on what to do after a scam app. If you lost money or had financial data stolen, also file with the FBI Internet Crime Complaint Center at ic3.gov, which routes complaints to the agencies that investigate them.

Then close the exposure the app may have created. Delete the app, then revoke its permissions and check whether it installed anything else or quietly subscribed you to a charge. If you entered a password it could have captured, change that password everywhere you reused it and turn on two-factor authentication. If you shared financial details, alert your bank and watch your statements. One hard rule cuts across all of it: recovery is never guaranteed, and anyone who contacts you promising to get your money back, “take the app down,” or “remove your data” for an upfront fee is running the recovery scam, a deliberate second hit aimed at people who were just defrauded once. No legitimate firm asks for a fee to unlock a recovery, and no one needs your passwords, seed phrases, or remote access to your phone.