Why Bad Code and Dark Patterns Are Still Ruining Our App Stores in 2026

My cousin called me from Onitsha last week, visibly upset. He’s been trying to fight off the reality of Sapa like everyone else, so when he stumbled across an app promising "zero-risk AI crypto arbitrage" with guaranteed daily returns, he deposited 50k Naira.

Three days later, the app wanted another 20k "withdrawal fee" before he could touch his money. When he asked me to look at the app, it took me about two minutes of inspecting the network requests to realize the whole thing was basically an unencrypted webview wrapping a glorified scam backend hosted on a cheap server.

It breaks my heart, but it also pisses me off as a developer. We like to pretend that Google Play and the Apple App Store are secure fortresses, but the reality on the ground is wildly different.

How Shady Apps Pass Store Reviews

People always ask me: "Samuel, if these apps are bad, how did Apple or Google let them into the store in the first place?"

It’s actually stupidly simple, and any software engineer who has pushed a few builds knows how the review pipeline works.

When you submit an app for review, automated scanners look at the static binary. Humans might tap around the UI for two minutes on a staging environment. To bypass this, bad actors build a squeaky-clean app that obeys every rule during review.

Once the app is approved and hits the store, they use remote config flags or dynamic code loading to swap out the UI or point the API endpoints to something entirely different. The app you downloaded on Monday isn’t the app that Google reviewed on Sunday.

App Submission -> Static Check Passed -> Approved -> Remote Config Triggered -> Scammer Mode Activated

By the time security researchers catch on and flag the developer account, the creators have already made their money, pulled the server offline, and bought a new developer license under a different alias.

The Permission Bloat Nightmare

If you ever open an Android app’s AndroidManifest.xml and see permissions like READ_CALL_LOG, ACCESS_FINE_LOCATION, and READ_CONTACTS on a basic flashlight or QR scanner app, run.

There is zero technical justification for a QR code scanner to need your contact list. Native APIs on modern iOS and Android versions handle camera input directly. You don't even need a third-party app for QR codes anymore—your default camera app handles the parsing natively without shipping your data anywhere.

Yet, millions of non-technical users get prompted with permission dialogs and just tap "Allow" because they want the utility. What they don't know is that behind the scenes, a background worker is scraping their address book to feed predatory loan apps or sell data to ad brokers.

The AI Subscription Trap

The newest wave of garbage on the stores right now comes wrapped in "AI" packaging.

I was hanging out at a workstation in Gbagada a few days ago, listening to a guy talk about how he spun up five different "AI Photo Editor" apps in a single weekend using Flutter and basic OpenAI API wrappers.

Building wrappers isn't crime, but the monetization models are borderline criminal. These apps hide a $10/week or 15,000 Naira/week recurring charge behind a deceptive "Start 3-Day Free Trial" button. They use aggressive UI dark patterns—making the close button almost invisible while keeping the "Subscribe" CTA massive and bright.

By the time the average user realizes they are being charged every single week for something that should cost pennies, the developer has already processed thousands of dollars in automated store billing.

What We Can Do As Developers

We can't rely entirely on big tech automated systems to protect our local communities. The bad guys are moving too fast, and the tools to generate throwaway apps are too cheap.

If you’re a developer building products for the local market:

1. Stop adding unnecessary permissions. Treat user data like radioactive material. If your app doesn't strictly need it to function, don't ask for it in your manifest.
2. Educate your people. Tell your friends, family, and tech-curious neighbors in Akure, Jos, or Owerri to stop downloading standalone utility apps for stuff their phone built-in settings already handle.
3. Call out dark patterns. When you see local products using deceptive subscription triggers or sketchy referral loops, call it out in public dev communities.

Building great software takes time, but ruining user trust takes just one bad download. Let's build stuff that actually lasts.