Android permissions to check before installing an exchange app in Pakistan

Most account takeovers in Pakistani crypto groups do not start with a hacked exchange. They start with a phone. Someone installs a loan app, a game booster or a so-called earning app from a link in a WhatsApp group, grants it every permission it asks for, and weeks later their exchange account is emptied by an app that could read the screen. Before you install or reinstall an exchange app, it is worth spending fifteen minutes on the phone itself. The checks below work on most Android versions sold in Pakistan, though menu names vary slightly between Samsung, Infinix, Tecno, Xiaomi and others.

Look at accessibility services first

Open Settings, then Accessibility, and look for a section called Installed apps, Downloaded services or similar. Legitimate entries are usually things like a screen reader, a password manager or the manufacturer's own tools. Any app there that you do not recognise, or that has no reason to control your screen, such as a flashlight, a wallpaper app or a cashback app, should be switched off and uninstalled. Accessibility access lets an app read text on screen and tap buttons for you, which is exactly what a thief needs to copy a password or approve a withdrawal.

Overlays, device admin and unknown sources

Next, search Settings for Display over other apps or Appear on top. Apps with this permission can draw fake login boxes over a real app. Remove it from anything that does not clearly need it. Then search for Device admin apps and make sure only familiar entries, like Find My Device, are active. Finally, check Install unknown apps and turn it off for your browser, WhatsApp and file manager. Exchange apps should come from Google Play, where you can open the listing and confirm the developer name matches the exchange before tapping Install.

What an exchange app actually asks for

Binance, OKX, Bybit and Bitget typically request the camera for identity verification and QR scanning, notifications for alerts, and sometimes storage or photos for uploading documents. They do not need accessibility access, and they do not need to be a device administrator. If an app claiming to be an exchange asks for either, uninstall it and report it. After installing, open the app's permission page in Settings and turn off anything you will not use, such as location, if the app works without it.

Keep the phone clean afterwards

Install system updates when they arrive, and turn on Google Play Protect scanning. Use a screen lock that is not your birthday. Avoid giving the phone to repair shops with the exchange app logged in; log out first or remove the app and reinstall later. If you ever find a suspicious accessibility service after the exchange app was already on the phone, assume your password may be exposed: change it from a different device, reset two-step login and review recent withdrawals on each exchange you use.

Risk boundary: Pakistan Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Open Accessibility settings and remove any installed service you do not recognise or need.
• Withdraw Display over other apps permission from apps that have no reason to use it.
• Turn off Install unknown apps for your browser, WhatsApp and file manager.
• Install exchange apps only from Google Play after checking the developer name on the listing.
• Change passwords from another device if you find a suspicious accessibility service later.