Is a casino APK safe? Play Protect, source and checks

Whether a casino APK is safe depends first on where it comes from. An APK is an Android installation package that reaches the device without going through Google Play, so it skips the screening every app in the store goes through. Which operators offer a package at all and where it comes from is summarised in the overview of the casino app for Android. The checks below start where the store is missing: with the source, with the file and with the system's warnings.

One forum answer sums up the starting point plainly: “APKs always carry a risk compared with screened apps from the stores.” Google itself recommends downloading via Google Play and warns that apps from unknown sources can endanger the device and personal data, up to damage, data loss and theft. Of the four casinos covered here, only 22Bet and Irwin name an Android app.

How to recognise a genuine operator APK

The first indicator is where the download comes from. A genuine operator APK sits on the casino's official website, not on a third-party domain that merely sounds similar. For 22Bet, goal.com names the official 22bet website as the only source. In a reply to AskGamblers, Irwin points to download icons on its own home page; no source says whether an APK or another route is behind them.

The second indicator is the file's key data, and here the sources differ. According to goal.com, the 22Bet APK is 55.36 MB and runs from Android 6.0; elsewhere the same source states “App Size 156 MB” without naming the platform. According to Uptodown, the file is 53.19 MB, requests 39 permissions and “requires Android 7.0 or higher”. None of the sources gives a version number. A file that differs clearly from both sizes deserves a second look at its origin. Source, file size and both source positions for the 22Bet app are collected on the brand page.

The third indicator is the signature. Every APK is digitally signed by its publisher, and Android only installs an update if the signature matches the app already installed. A forum user describes the result of a foreign package briefly: “The different signature blocks the installation.” If an update over an existing casino app fails with exactly this message, the new file does not come from the same publisher as the old one.

If a third-party APK site offers the file instead of the casino, its mandatory details are worth a look. One forum user explains his distrust of such a site with “empty privacy policy, no imprint, no contact person”. Another names as a sign of a fake that “the file size is 10 MB, while the original is 200 MB”.

Play Protect: warning and scan

Google Play Protect is switched on by default on Android devices. It checks apps during installation and scans the device regularly, including apps from other sources. Play Protect reports potentially harmful apps, disables them or removes them; if an app or URL is known to be harmful, Google can block its installation. Unverified apps with sensitive permissions, which are often used for financial fraud, can also be prevented from installing.

Two messages come up again and again in forums, and they mean different things. One reads roughly: “Android blocks this app because it is or may be harmful”. Here Play Protect has classified the file as harmful, and the installation should stop at this point. The other reads “cannot be verified”: Play Protect does not know the app because it was never distributed via Google Play. That is not a statement about malicious code but about missing data. For such apps that have never been scanned, Play Protect can recommend a code scan.

The second message is usually followed in forums by the advice to “allow programs from unsafe sources”. That permission concerns a different part of the system: it decides whether the browser or file manager may install packages at all, and it does not switch Play Protect off. Where the setting sits depending on the Android version and how to revoke it afterwards is described in the guide on how to allow unknown sources, up to Android 7.1.1 and from Android 8 separately. Whether Play Protect is running is shown in the Play Store under Profile › Play Protect › Settings by the switch “Scan apps with Play Protect”; Google recommends always keeping it on.

APK portals instead of the operator site

Many users download APKs not from the operator but from portals such as APKMirror, Uptodown or F-Droid. A forum post says that anyone who “has no Play Store and now installs apps as APKs” should choose a reliable site. For casino apps the background is different: in Germany Google Play only admits sports betting, horse racing and lotteries as gambling apps, while online casino games are missing from the list. Anyone looking for a real-money casino app who finds only play-money offers in the store quickly ends up on a portal.

A portal is a copy, not the original. Who uploaded the file, which version it is and when it was updated is decided by the portal, not by the casino. That portal and operator details can drift apart is shown by the differing key data of the 22Bet APK above. A differing figure is not yet a sign of a tampered file, but it shows that two sources do not describe the same state. If the APK is also available from the operator, its site is the shorter chain, and later updates then come from the same publisher.

Checking the file before installation

One forum tip is to run “every app out of the wild” through VirusTotal before installing it, in other words to upload every APK that does not come from a store there before tapping it for the first time. Together with the address the file came from and a comparison of the file size with the known figures, this makes up the check that takes the place of the store for an APK.

You do not need a separate “APK Installer” from the web for this. In the forum the answer is short: “You don't need your own APK installer either.” Android opens the file with its own package installer. The full sequence of download, permission, installation and update is shown in the step-by-step guide on how to install a casino app, including the typical error messages.

From Android 13 onwards there is a further barrier: when an app is installed, sensitive device settings such as accessibility services can be restricted. They can only be released via “Allow restricted settings” in the app info, and Google advises against this unless you trust the developer.

What to do after a suspicious installation

The most common worry in the forum follows a blocked installation: “Has the virus been fended off as well?”, asks a user after his phone stopped the APK because of a virus risk. If Play Protect blocked the installation, the app never landed on the device. The downloaded file remains in the downloads folder and can be deleted there so it is not opened by accident later.

A similar case comes from a user who, by his own account, checks every APK: “Every time I download an APK, I check the app via VirusTotal.” For a file that was downloaded but not installed, the service reported 12 detections, and his follow-up question was “Should I reset my phone?”. In another thread on the same worry, the answer reads: “Nothing can happen from a download alone, don't worry.”

If the app is already installed, the regular Play Protect check described above remains in place. Whether an installed APK gives any reason for concern at all, one forum user answers with “It depends on the source.”

Not every worry after installation concerns the file itself; some concern the money. On AskGamblers a player complains: “22Bet is not even showing my deposit as processing in the app.” Which payment methods and limits the four casinos offer is set out on the page on deposits and withdrawals in the app.