6 ms·

Similar abuse occurs in Apple's ecosystem as well. It was really easy to subtly sign someone up for a $99/week subscription, but I'm not sure if this is still t

Similar abuse occurs in Apple's ecosystem as well. It was really easy to subtly sign someone up for a $99/week subscription, but I'm not sure if this is still the case. A lot of these scam apps appeared regularly in the App Store's "Top Grossing" charts — easily millions of dollars every month were/are going to these kinds of apps. This is an interesting example of incentive alignment — in some sense, it's in Apple's best interest to let this abuse slide since they're also profiting off of it (though obviously that's not a long-term, deliberate strategy). This article covers it well: How to Make $80,000 Per Month on the Apple App Store (https://medium.com/@johnnylin/how-to-make-80-000-per-month-on-the-apple-app-store-bdb943862e88 https://medium.com/@johnnylin/how-to-make-80-000-per-month-o...)

deleted 7y ago
[deleted]
texuf 7y ago
How are these apps getting past app store review?
- Nextgrid 7y ago
  I wonder if the prices can be adjusted after the app is published. So the scammer publishes the app with a reasonable price, gets past review, then ups the price and profits.
  - saagarjha 7y ago
    Yes, you can apparently do this via App Store Connect.
- saagarjha 7y ago
  App Store Review isn't very consistent or thorough.
BLKNSLVR 7y ago
One of my kids managed to somehow bypass the restrictions I'd put in place on their device and signed up to a subscription that was a free three day trial, after which it would cost $79 per year. Luckily I also get emailed whenever there's activity on the account. Kid can't remember doing it, doesn't know how they did it, was upset at themselves. Device is locked down even harder now - as a result of looking up all the myriad settings to stop scams getting through and credit card details removed from the account. It should be hard to subscribe and easy to lock down. Not the opposite. The default should be "no spend". And this is from our heroes of privacy: Apple. (Not Apple bashing here; entire industry bashing. They're all grossly immoral no matter how legal it all is)
- CDSlice 7y ago
  Apple has gotten better at these things, now you can set up a kid's device to forward all requests to purchase apps or IAPs to the parent's device which has to approve it. I also don't remember it being very hard to lock down purchasing using parental controls in older versions of iOS, if you don't mind me asking which version of iOS was the kid running?
  - BLKNSLVR 7y ago
    iOS version, I'm not sure precisely, maybe two versions back from whatever is current. The device was / is setup using my account since I'm not ready to let them have their own account - whether it's a child account or otherwise. I don't use iDevices though, so there's no security compromise between what I want to be able to with the account and what restrictions I want on the kids. I had specified a password was required for any purchase, and to my knowledge this was still the case when the incident occurred. The additional locking down was done via the (relatively new at the time) Screen Time restrictions, plus requiring a password for ANY app installs (free or paid). My assumption (and that's all it is) is that because the trial was free, it was allowed without a password, where the "gotcha" is the auto-pay upon trial expiry. I also assume that this subscription process was started due to an in-game advertisement dark pattern that lead towards unknowningly signing-up. (I will accept without argument some amount of blame on the "bad parent deserved it for not observing their kids' device activity" spectrum. Also if there are additional restrictions on children's accounts - but I have my own squeamishness about setting up account details for a minor)
thrwn_frthr_awy 7y ago
Apple Arcade is their solution to this. Pull the pressure off developers to build IAP's into their apps and see the quality of app increase.
nyuszika7h 7y ago
It wasn't too hard to pull off this trick with Touch ID devices - you put your finger on the home button and before it goes back to the home screen it authenticates the purchase with your fingerprint. Apple has put some measures in place to prevent this from happening, or at least notify you immediately about the purchase if you leave the app before it's completed. Since the iPhone X with Face ID, you have to double tap the side button to authorize a purchase, so it's not so easy anymore. Fortunately, you can get a refund within 14 days, no questions asked, by going to reportaproblem.apple.com and choosing "I would like to cancel this purchase". If you're outside the EU or it's been longer than 14 days, you can try the "I would like to request a refund" option - you will be either refunded automatically or it will be sent to Apple support for review and they'll get back to you within 48 hours. I've actually had luck with refunding an app and an IAP even when someone manually reviewed it, but YMMV.

deleted 7y ago

[deleted]

texuf 7y ago

How are these apps getting past app store review?

Nextgrid 7y ago
I wonder if the prices can be adjusted after the app is published. So the scammer publishes the app with a reasonable price, gets past review, then ups the price and profits.
- saagarjha 7y ago
  Yes, you can apparently do this via App Store Connect.
saagarjha 7y ago
App Store Review isn't very consistent or thorough.

BLKNSLVR 7y ago

One of my kids managed to somehow bypass the restrictions I'd put in place on their device and signed up to a subscription that was a free three day trial, after which it would cost $79 per year. Luckily I also get emailed whenever there's activity on the account. Kid can't remember doing it, doesn't know how they did it, was upset at themselves. Device is locked down even harder now - as a result of looking up all the myriad settings to stop scams getting through and credit card details removed from the account. It should be hard to subscribe and easy to lock down. Not the opposite. The default should be "no spend". And this is from our heroes of privacy: Apple. (Not Apple bashing here; entire industry bashing. They're all grossly immoral no matter how legal it all is)

CDSlice 7y ago
Apple has gotten better at these things, now you can set up a kid's device to forward all requests to purchase apps or IAPs to the parent's device which has to approve it. I also don't remember it being very hard to lock down purchasing using parental controls in older versions of iOS, if you don't mind me asking which version of iOS was the kid running?
- BLKNSLVR 7y ago
  iOS version, I'm not sure precisely, maybe two versions back from whatever is current. The device was / is setup using my account since I'm not ready to let them have their own account - whether it's a child account or otherwise. I don't use iDevices though, so there's no security compromise between what I want to be able to with the account and what restrictions I want on the kids. I had specified a password was required for any purchase, and to my knowledge this was still the case when the incident occurred. The additional locking down was done via the (relatively new at the time) Screen Time restrictions, plus requiring a password for ANY app installs (free or paid). My assumption (and that's all it is) is that because the trial was free, it was allowed without a password, where the "gotcha" is the auto-pay upon trial expiry. I also assume that this subscription process was started due to an in-game advertisement dark pattern that lead towards unknowningly signing-up. (I will accept without argument some amount of blame on the "bad parent deserved it for not observing their kids' device activity" spectrum. Also if there are additional restrictions on children's accounts - but I have my own squeamishness about setting up account details for a minor)

thrwn_frthr_awy 7y ago

Apple Arcade is their solution to this. Pull the pressure off developers to build IAP's into their apps and see the quality of app increase.

nyuszika7h 7y ago

It wasn't too hard to pull off this trick with Touch ID devices - you put your finger on the home button and before it goes back to the home screen it authenticates the purchase with your fingerprint. Apple has put some measures in place to prevent this from happening, or at least notify you immediately about the purchase if you leave the app before it's completed. Since the iPhone X with Face ID, you have to double tap the side button to authorize a purchase, so it's not so easy anymore. Fortunately, you can get a refund within 14 days, no questions asked, by going to reportaproblem.apple.com and choosing "I would like to cancel this purchase". If you're outside the EU or it's been longer than 14 days, you can try the "I would like to request a refund" option - you will be either refunded automatically or it will be sent to Apple support for review and they'll get back to you within 48 hours. I've actually had luck with refunding an app and an IAP even when someone manually reviewed it, but YMMV.