Summary

Epic Games’ lawsuit against Google has led to a court ruling that requires Google to open its Play Store to third-party app stores for three years. This move aims to address monopoly concerns and reduce the 30% commission fee on in-app purchases. The decision differs from Epic’s case against Apple, particularly in terms of legal outcomes and platform control. While Epic celebrates the ruling as a victory, Google has raised concerns about potential unintended consequences, including an increased risk of mobile malware due to fragmented app store oversight. Fraud prevention professionals are advised to remain vigilant as these changes unfold.

Case Ruling

On October 7, Judge James Donato issued his final ruling in the Epic v. Google case, ordering Google to open the Google Play Store to competition for three years. Google must allow rival third-party app stores to be distributed through Google Play and provide them access to its full catalog of apps unless individual developers opt-out.

Epic Games, known for its game store, filed the lawsuit not only to address monopoly concerns but also to secure a fairer revenue share for developers. By bypassing the Google Play Store, Epic seeks to avoid the 30% commission fee Google charges on in-app purchases—a fee many developers consider excessive.

Starting November 1, 2024, and continuing until November 1, 2027, Google is ordered to refrain from any actions that would hinder this process.

Epic views this as a victory, believing it will enable them to distribute their app store through Google Play, although they expect potential legal delays. Google, however, argues that these changes will lead to "a range of unintended consequences that will harm American consumers, developers, and device makers," and plans to appeal.

Differences and Similarities with the Apple Case 

Epic has also similarly sued Apple. While the lawsuits against Google and Apple share several similarities, there are key differences, particularly in the legal outcomes and the way these tech giants control their platforms. 

Table: similarities and differences between Google and Apple cases 

Impact on Mobile Malware Threats

Google’s claim of unintended consequences might hold some validity. ThreatFabric has been tracking mobile campaigns and actor groups for years, and trust in the Google Play Store is frequently exploited by criminals. Many of these malicious apps start as harmless, such as PDF readers, file managers, phone cleaners, or QR code scanners. Criminals often buy these apps from other criminals who specialize in creating droppers disguised as simplistic “copycat” apps. Sometimes, they create the apps themselves. These seemingly benign apps operate as expected for weeks or months before new versions with malicious code are deployed.

Figure: timeline example of “Anatsa” nurturing multiple apps 

Opening up the Play Store to other app stores could create more opportunities for criminals to spread malicious apps. It fragments control over app content, and newer stores might have less stringent checks, allowing malicious code to slip through more easily. This could ultimately make it easier for criminals to carry out their activities.

Do Fraud Prevention Professionals Need to Worry? 

Modern mobile malware is packed with functionalities, such as key logging, remote access, and screen overlays, that enable fraudsters to gain full access to a victim's mobile banking apps. Any loosening of the controls around app releases should be of interest to threat intelligence and fraud professionals. In the very short term, technical changes to the Play Store are needed to comply with the court ruling. Google claims these changes are non-trivial and could take months. They also have various legal options to delay the process. At the very least, fraud prevention and threat intelligence professionals need to stay updated on trends and keep informed about the evolution of malicious app campaigns.