A free VPN app called “Turbo Secure VPN” stayed in the top 50 productivity apps for eight months before anyone noticed it wasn’t actually routing traffic through a VPN tunnel. It just displayed a connected status icon while doing nothing. The app collected location data, browsing history, and contact lists the entire time. When it finally got pulled, it had 2.3 million installs.

The app store review process caught none of this. Neither did the initial user reviews, which were mostly five stars. This wasn’t a sophisticated attack. It was theater.

Here are the six tactics that make the VPN scam economy work, and why they keep succeeding.

Tactic one: fake server infrastructure

Real VPN services maintain actual server infrastructure across multiple countries. Scam VPNs fake this with lorem ipsum location lists and stock photos of data centers. The trick is they do implement basic DNS routing through a single cheap VPS, enough to change your visible IP address on a speed test website. Users see a different IP, assume the VPN works, and never check if their traffic is actually encrypted or if the app is logging everything.

Testing this properly requires packet inspection tools most people don’t have. The scammers know this. They optimize for passing the casual sniff test, not actual security.

Tactic two: permission abuse hidden in updates

A VPN app legitimately needs network permissions. That’s the wedge. Version 1.0 ships clean. It asks for network access, maybe location to show “nearest server.” Reasonable. Version 1.4, three months later, adds contacts permission. Version 2.1 wants access to external storage. Version 2.8 requests phone state and identity.

Each update adds one permission, separated by enough time that users don’t connect them. Android’s permission system shows each request individually but doesn’t highlight the cumulative creep. By version 3.0, the app has SMS access, full contact lists, and storage permissions it has no legitimate need for.

The VPN functionality is just permission cover for a data harvesting operation.

Tactic three: the premium version misdirection

The app offers a free tier and a premium tier. The free tier is ad-supported, slow, and limited to one server location. Premium costs $9.99 monthly for “military-grade encryption” and “50+ countries.” This creates an illusion of legitimacy. Real businesses have paid tiers. Scams are free. Right?

Wrong. The paid tier exists to make the free tier seem safe by comparison. “If they’re charging for premium, they must be a real company.” Meanwhile, both tiers have identical tracking implementations. Premium users just paid to be surveilled. The payment processing also provides the scam with verified identity information and payment details.

Some variants take this further. They offer a “lifetime premium” option for $49.99, collect the money through a shell payment processor, then vanish. The app stops working six weeks later. No refunds.

Tactic four: astroturfed trust signals

Go read VPN app reviews on the Play Store. Notice how many five-star reviews say almost nothing? “Works great!” with a verified purchase badge. “Fast and easy.” Posted within 24 hours of each other, with similar sentence structures.

These aren’t real users. They’re click farms or automated bot networks. A scam VPN can buy 10,000 five-star reviews for about $3,000. That puts it above legitimate competitors who don’t pay for reviews. The star rating becomes a trust proxy. Users sort by rating, see 4.6 stars with 50,000 reviews, and assume safety in numbers.

App stores have detection systems for this, but scammers rotate through new apps faster than the detection catches up. By the time an app gets flagged, the operator has already launched three new ones with different names.

Tactic five: the privacy policy shell game

Every scam VPN has a privacy policy. They have to. But the policy either says nothing specific or contradicts the app’s actual behavior. Common patterns: “We may collect certain information to improve our services.” What information? “Data necessary for functionality.” What functionality requires your SMS logs?

The policy exists for legal compliance, not disclosure. It’s written by someone who knows how to make vague statements that technically don’t promise anything. If the app gets caught, the operator points to the policy and says users consented. The policy mentioned data collection. Not their fault users didn’t read 6,000 words of legalese.

Some policies explicitly state data sharing with third parties but bury it in section 8.3.4 under “Our Business Partners and Service Providers.” That section appears after four paragraphs about cookies and two about California residents’ rights.

Tactic six: the legitimate business facade

The scam operator registers a business entity. They set up a website with stock photos and testimonials. They publish social media accounts that post generic privacy tips. They might even run a blog. This costs maybe $500 and two days of work.

Now when users Google the company name, they find evidence of legitimacy. A website. A Facebook page. An address (probably a UPS Store box, but it’s an address). The app store listing links to these properties. Everything looks real because the surface layer is real. The scam is what happens after installation.

What actually stops this

App stores could require VPN apps to demonstrate actual server infrastructure before approval. They could audit network traffic during review. They could implement permission escalation limits that flag apps adding unrelated permissions in updates.

They don’t, because that review process would be expensive and slow. Keeping the submission pipeline fast matters more than catching scams. The current approach is reactive. Wait for user reports, then investigate, then remove. By then, millions of installs have happened.

The economic incentives guarantee this continues. A scam VPN can generate $50,000 in data sales and ad revenue before getting caught. The cost of setting up a new one is under $1,000. The math works.

Until app stores treat VPN scams as a category worth dedicated enforcement rather than individual bad actors, the playbook stays the same. Different apps, same tactics, same results.