Social Engineering — Social engineering and scareware

This covers content or UI designed to alarm users into a hasty action — false claims of malware infection, urgent "your device is at risk" messaging — used to drive installs, purchases, or permission grants through fear rather than genuine need.

A frequent pattern is an ad creative (sometimes from a third-party ad network, not the app itself) claiming the user's phone is infected, which links through to install another app.

The short version, in more detail

The social-engineering policy targets content designed to alarm users into acting quickly, such as claims that their device is infected or urgent warnings that it is at risk. These tactics drive installs, purchases or permissions through fear instead of real need. A frequent pattern is an ad creative from a third-party network claiming the phone is infected and linking to another app.

Why this rule exists

Fear shortens thinking. People who believe their phone is compromised may grant permissions or pay for a fix without checking whether the threat is real. Scareware has long been a way to push unwanted software, and it harms trust in genuine security tools. Google treats these tactics as abusive in their own right, even when no malicious code is involved.

What this guideline covers

• False claims of infections, errors or risk.
• Urgent or alarming messaging that pressures users.
• Ads and in-app content that use these tactics.
• Prompts that push installs or purchases through fear.

What usually triggers this rejection

• An ad claiming the phone is infected.
• A fake scan that always reports problems.
• Countdowns and warnings designed to force action.
• A cleaner app that exaggerates device issues.
• Messages that impersonate security alerts.

How reviewers evaluate it

• Reviewers run scans and observe the messages shown.
• They check ads delivered by SDKs.
• They compare claims about the device with reality.
• User reports of scareware can lead to review.

Common misunderstandings

• Marketing urgency can cross the line when it creates false alarm.
• Third-party ad content is still the developer's responsibility.
• A fake scan is treated as deception, not as a feature.

Common questions