Apple’s App Store isn’t always as trustworthy as the company claims. The latest example comes from RockAuto, an auto parts retailer popular with do-it-yourselfers and other do-it-yourselfers, which is upset that a fake app masquerading as an official app has not been removed from the App Store despite numerous complaints to Apple.
RockAuto co-founder and president Jim Taylor first became aware of the situation when customers complained about “annoying ads” on the app – something that “surprised us since we don’t have an app,” he said.
“We discovered that someone had placed an app with our logo and company information on the Apple App Store – albeit with the misspellings and clumsy graphics typical of phishing attacks,” he told TechCrunch.
If you look closely, the fake app doesn’t look very real, but it’s easy to see how someone could be fooled. The images on the App Store show a photo of a truck with the word “Heading” over the image, as if a template was hastily used and the work was not yet completed. Additionally, despite the app being titled “RockAuto” in the App Store, the app refers to itself as “RackAuto” throughout the App Store description.
Additionally, it promises its customers that “your privacy is top priority” and that “all your data is securely stored and encrypted, giving you peace of mind.” That’s unlikely given the nature of this app.
The problem is concerning not only because the app is capable of deceiving at least some of RockAuto’s customers, but also because it undermines Apple’s message that the App Store is a trustworthy and safe marketplace – and why It requires developer involvement in app purchase transactions. The tech giant is pushing back against regulations such as the EU’s Digital Markets Act (DMA), claiming these laws put customers’ security and privacy at risk. Apple believes customers are at risk when they do business outside of the company
App Store with unknown parties. But as these cases show, criminals can all too easily infiltrate your own app marketplace.
Photo credit: Fake RockAuto app on the App Store
According to documentation the company shared with TechCrunch, Apple has so far ignored RockAuto’s requests to remove the fake app, all of which were sent through appropriate channels.
While searching for a solution to this issue, RockAuto came across our reporting on a similar situation with LastPass. Password Manager also fell victim to a similar scheme when a fake app pretending to be LastPass was available on the App Store for weeks. LastPass ended up having to publicly warn its customers in a blog post because Apple only removed the fake app after it received press coverage and published LastPass’s own post.
Apple did not respond to requests for comment at this time. The company also could not immediately be reached for requests for comment on RockAuto’s complaint.
Taylor says RockAuto’s customer service manager initially contacted Apple to resolve the situation. When he received no response, Taylor intervened.
“It’s largely one-sided, as the only responses we’ve received from Apple are: ‘You shouldn’t have sent an email, use the online form’ and ‘Download screenshots of the App Store listing and yours Trademark registration up,’” explains Taylor RockAuto had already done both, according to the documentation.
“Neither the uploaded documents nor the online form submissions resulted in any response at all,” Taylor noted, “not even the promised ‘case count in 24 hours’ despite multiple submissions,” he said.
Since filing the complaint on April 18, 2024, RockAuto has notified Apple of its trademark registration, sent an email to the company, called the number listed on Apple’s copyright infringement page, submitted a DMCA takedown request, and completed Apple’s required forms .
She has received no replies other than automated replies and the fake app remains active at the time of publication