Second Look: Scam App Check

Second Look is a quiet second opinion on the apps installed on your phone.

It was built for people who are perfectly capable of running their own lives, but who were never taught the tricks digital fraudsters use. It does not take decisions away from you. It notices things, explains what it noticed, and leaves the choice where it belongs — with you.

WHAT IT LOOKS AT

Second Look examines the apps on your phone for patterns that appear again and again in Indian fraud cases:

• Apps installed from outside the Play Store, especially during a phone call
• Apps asking for combinations of permissions that do not match what they claim to do
• Apps imitating a bank, a wallet, or a government service
• A screen-sharing or remote-access app running while you open a banking or UPI app

For anything it flags, it tells you what it saw and why that pattern matters. For example:

"This app was installed from a link, not from the Play Store, while you were on a call. Fraudsters often stay on the line and talk someone through the installation, because the app has to be on your phone before anything can be taken from it."

That explanation is the point. Over time, you should need us less.

WHEN SOMETHING LOOKS WRONG

Most days Second Look has nothing to say, and says nothing. Quiet is the normal state.

When something is worth mentioning, it shows what it noticed and how it reached that view. When something looks actively dangerous — a remote-access app running while your banking app is open, during a call — it interrupts, and suggests the most useful thing available to you: talk to someone you trust before going any further.

It does not contact anyone on your behalf. If you want a second opinion from family, that is your decision to make and your call to place.

WHAT IT DOES NOT DO

• It does not remove, block, or disable apps. It tells you; you decide.
• It does not read your messages, your email, or your bank details.
• It has no battery boosters, memory cleaners, or speed optimisers.
• It cannot catch every scam, and does not claim to. New tactics appear constantly, and some fraud happens entirely in conversation, where no app can see it.

PRIVACY

The list of apps on your phone is examined on your device and shown only to you. The list itself is never uploaded.

When an app is sideloaded or looks high-risk, Second Look checks it with VirusTotal automatically, once a scan finishes. What is sent is a fingerprint of that app's installer file — not the file itself, and none of your personal data. If the fingerprint cannot answer the question, that app's package name is sent as well. You can also run the same check yourself, from any app card.

Second Look also records how the app itself is used — whether a scan finished, whether a warning was opened — so we can tell it is working. These carry no app names and nothing that identifies you personally, are deleted after 90 days, and cannot be switched off.

Crash reports help us find faults and can be switched off in Settings. The app also fetches its warning wording from our server, so explanations can improve without an app update; that fetch identifies your installation to Google's Firebase service.

The full detail is in our privacy policy: https://openclawbot1984-a11y.github.io/finshield-legal/privacy

WHY IT ASKS FOR WHAT IT ASKS FOR

• Usage Access — to see which app is in front. This is how a remote-access scam is recognised at all. You grant it by hand in Settings and can withdraw it any time.
• Notifications — so a warning can reach you when it matters.
• Access to the list of installed apps — so every app can be examined. A fraudster's app has a name nobody can know in advance, which is why the list cannot be narrowed ahead of time.

WHO IT IS FOR

Adults who manage their own money and their own phone, and who would like a calm, well-informed second opinion before tapping something that cannot be undone.