14 DAY TRIAL // Two apps from Apple's iOS App Store were tricking users into unknowingly making payments for in-app purchases that were hidden behind a seemingly legitimate app feature.
The two apps, called "Calories Tracker app" and "Fitness Balance app," used a dodgy payment mechanism disguised as a fingerprint scanner that would collect health metrics to generate diet recommendations based on a supposed personal calorie tracking algorithm according to a Reddit post.
Moreover, on the fingerprint scanning screen, the apps would tell users that the scanner is used to "Create personalized diet and other stuff by your fingerprint."
"Only moments after the user complies with the request and places their finger on the fingerprint scanner, the apps then display a pop-up showing a dodgy payment amounting to 99.99, 119.99 USD or 139.99 EUR," says security researcher Lukas Stefanko.
The pop-up will only be displayed for up to one second, and it will lead to the money being sent to the scammer's account if the victim attached a credit or debit card to their Apple account.
Enabling "Double Click to Pay" can help iPhone X users avoid getting scammed in the future
Although they seemed to be legitimate fitness and calories tracking tools at first glance, their malicious behaviors prompted multiple users to report them to Apple which led to their removal from the App Store.
Furthermore, although designed to steal money from their users, the two apps had average ratings of 4.3 stars and mostly positive reviews, a well-known technique used by scammers when peddling their fake apps according to Stefanko.
As a mitigation measure for this type of scam in the future, Stefanko added that iPhone X users could enable the "Double Click to Pay" feature introduced in iOS 11.1.1 which requires users to confirm payments by double-clicking the side button.
Additionally, all victims of this scam can ask for refunds from Apple which could potentially help to get back the stolen money.
