Android app permissions: what a betting or gaming app should never get

A betting or casino app needs very little from your phone: an internet connection, which Android grants without asking, and perhaps permission to send notifications. That is close to the full list. When an app asks to read your SMS, use accessibility services, see your contacts or draw over other apps, it wants access to your OTPs and your screen, and no honest betting product needs either.

This matters more in India than in most places, because the same cheap Android that holds a betting shortcut usually holds the UPI app, the bank app and the SMS inbox where every OTP lands. One careless "Allow" can connect them all.

The permissions that should stop you at once

Some permissions are a warning sign whatever the app is called. If a betting, casino or "prediction" app asks for any of these, tap Don't allow and remove the app:

• SMS (read or receive messages). Your bank OTPs arrive by SMS. An app that can read them can approve payments you never made.
• Accessibility. Meant for people with disabilities, it lets an app read everything on screen and tap buttons for you. Fraud apps use it to watch UPI screens.
• Notification access. Many OTPs also show up as notifications. Reading them is as good as reading the SMS.
• Display over other apps. This lets an app place a fake window on top of your real banking app.
• Contacts and call logs. Used to spam your friends with "join now" links, or to pressure you when a loan app is involved.
• Device admin. An app with this right can make itself hard to remove.

Google Play limits which apps may request SMS and call-log access at all, and most ordinary apps never ask for them. So the request itself tells you a lot about where the app came from.

What a normal app might ask, and why

A few requests have an innocent reason, as long as they come at the right moment. Notifications: for match alerts or bonus news, and you can say no without losing anything. Camera: only at the moment you choose to photograph a document for KYC, and "Only this time" is the right answer. Storage or photos: only if you choose to upload a picture yourself.

Location is a grey area. Some apps use it to check which country you are in. If you allow it, choose "While using the app" and "Approximate" rather than precise location.

The rule we use at our desk: a permission should appear when you tap the feature that needs it, not in a burst of pop-ups the first time the app opens. A row of requests on the first screen is an app collecting whatever it can.

How to check permissions on your phone

You can see everything an app already has in under a minute. Menu names differ slightly between Samsung, Xiaomi, Realme, Vivo and stock Android, but the path is close to this:

1. Open Settings and go to Apps (on some phones, Apps & notifications).
2. Tap See all apps and choose the app.
3. Tap Permissions. You will see Allowed and Not allowed lists.
4. Tap each allowed item and set it to Don't allow or Ask every time.
5. Go back and look for Special app access or Advanced. Check Display over other apps and Notification access there too.

For accessibility, open Settings, search "Accessibility", then look under Installed apps or Downloaded apps. Anything there that you did not switch on yourself should be switched off. To see the whole phone at once, search Settings for "Permission manager": it lists which apps hold SMS, contacts, camera and location.

Read the store listing before the app reaches your phone

The best time to judge permissions is before you tap Install. In Google Play, open the listing and scroll to Data safety. It shows what the developer says the app collects and shares: phone number, contacts, financial info, location. On the App Store the same idea sits under App Privacy.

Then tap the developer name. A real developer has a website and an e-mail you can compare with the operator's own site, and usually other apps with a history. A listing with one app, a generic Gmail address and a handful of five-star reviews written in the same week is not convincing.

Reviews help too. Sort by most recent and read the one-star reviews. People complain loudly when an app starts sending SMS or when money moves without their say.

If an app is not in either store at all, do not chase a copy of it through links. Use the operator's mobile site in Chrome or Safari instead. A browser tab cannot read your SMS or watch your UPI app, which is the single strongest argument for it.

Turn on the protections Android already has

Two settings do quiet work in the background. First, open the Play Store, tap your profile picture, then Play Protect, and keep Scan apps with Play Protect on. It checks apps on the phone against known harmful ones.

Second, recent Android versions remove permissions from apps you have not opened for a few months. In the app's info screen, look for Pause app activity if unused or Remove permissions if app is unused and keep it on. An old app that you forgot about then cannot keep reading your messages.

Also keep the phone's own system updates current. Security patches close the holes that bad apps try to use.

If you already allowed the wrong thing

Act in this order, and do it on the same day:

1. Switch off the risky permissions using the steps above, then uninstall the app.
2. Open your UPI and bank apps and check recent transactions and any new linked devices.
3. Change your UPI PIN and banking password from the official bank app.
4. If money left your account, ring your bank to freeze the channel, then dial 1930 for cyber fraud or file at cybercrime.gov.in. Speed matters: early reports give the best chance of freezing money in transit.
5. Tell friends not to open links that may have been sent from your number.

A betting site should be a place you visit, not something that sits inside your phone reading your messages. If the app you found wants more than notifications, the browser tab is the better choice, and nothing about your bets will change.

Only adults of 18 or over should bet at all, and any stake can be lost.