Casino App Permissions on Android: Overlay, Accessibility and What to Refuse

What this page covers

• Why permissions matter more than the icon
• A table of permissions and whether a lobby needs them
• Display over other apps (overlay)
• Accessibility services
• SMS and notification access
• Why you are outside the store in the first place
• What an APK contains
• Other sideloading risks
• Checks before installing, and an audit afterwards
• iPhone and iPad
• Android version, storage and device basics
• Data, battery, notifications and tracking
• Troubleshooting table

Why permissions matter more than the icon

A counterfeit casino app does not need to break Android's security. It only needs the user to say yes. Each permission prompt is a request for a specific power, and the system will grant whatever is approved. An attacker's work is mostly persuasion: a message saying the permission is "required for secure login" or "needed to receive your bonus".

A casino lobby is a set of web pages with a cashier. It needs an internet connection and very little else. Keep that baseline in mind and every extra request becomes a question the app has to answer.

Permissions and whether a lobby needs them

The first four are explainable. The remaining six have no role in spinning a reel or joining a table, and any one of them is reason enough to cancel the install.

Display over other apps

Overlay permission lets an app place its own window above another app. Chat bubbles and screen filters use it legitimately. A malicious app uses it to cover your e-wallet's screen with a fake one, so that the MPIN you type goes to the overlay, or to hide a confirmation button under an innocent-looking prompt.

Android treats this as a special permission: it is granted on a separate settings screen rather than in a pop-up. If an app walks you to that screen with step-by-step arrows, it has planned for your hesitation.

Accessibility services

Accessibility services exist for people who need a screen reader or switch control. To do that job, a service can read what is displayed in any app and perform gestures on the user's behalf. In the wrong hands that is complete control: it can read a balance, open a wallet, enter an amount and approve it.

Recent Android versions add friction here. Since Android 13, an app installed from outside a store is blocked from accessibility and notification access by default under a rule called restricted settings, and the user must deliberately lift the block. Instructions that tell you how to "allow restricted settings" are instructions for disarming that protection.

SMS and notification access

One-time passwords arrive by text or as notifications. Permission to read SMS, or to read all notifications, gives an app those codes the instant they land. Combined with your phone number and a password captured at login, that is everything needed to move money. No casino feature depends on reading your messages.

Why you are outside the store in the first place

Google Play and the App Store accept real-money gambling apps only from approved, licensed operators and only for countries each store allows, after an application. Most lobbies promoted to Philippine players have not obtained a listing. That is why the app is offered as a file, and why the permission review falls to you instead of to a store.

Where a licensed operator has a real store listing, install from the store. The listing shows a data-safety summary and the publisher's name before anything is downloaded.

What an APK contains

An APK is Android's installer package. Along with the code and images it holds a manifest: a declared list of every permission the app might ask for. It also carries the packager's signature, which Android uses to make sure later updates come from the same source. The signature identifies consistency, not honesty.

Other sideloading risks

• Fake builds. A copied lobby with added code looks identical to the original.
• Malware. An installer can deliver a second, hidden app.
• No automatic updates. Fixes do not arrive unless you install them by hand.
• No refunds. Losses through a counterfeit cashier have no store dispute route.

Permissions tie these together. A fake build is dangerous mainly because of what it is allowed to do once installed, and a bundled second app usually reveals itself by asking for access the lobby never needed.

Checks before installing, and an audit afterwards

Before:

1. Type the operator's address and download only from that domain.
2. Confirm the licensee named on the site appears on PAGCOR's published list.
3. Leave Play Protect on.
4. Read each prompt and refuse anything in the "No" rows above.

After, and again every few weeks:

1. Open Settings, then Apps, then the casino app, then Permissions. Remove anything unnecessary.
2. In Settings, search for "Display over other apps" and "Accessibility". Make sure the app is not listed as allowed.
3. Search for "Notification access" and "Device admin apps" and check the same.
4. Turn off "Install unknown apps" for the browser or file manager you used.

Menu names vary by phone maker; the settings search box finds them.

If an app you did not knowingly approve appears in any of those lists, remove its access first, then uninstall it. Some harmful apps hold device-administrator status precisely so that the uninstall button is greyed out; withdrawing that status in the device admin list restores it.

iPhone and iPad

iOS has no overlay or accessibility-service equivalent that a web shortcut can request, which is one reason the usual "iOS app" for a lobby is simply a Safari page saved with Add to Home Screen. The risk on iOS takes a different form: a configuration profile or an enterprise certificate you are asked to trust in Settings. Either can give a third party deep access, and neither is needed to open a website.

Android version, storage and device basics

Supported versions are set by the operator: check its help page. In general, newer Android releases offer finer permission controls, including one-time grants, automatic removal of permissions from unused apps and the restricted-settings rule described above. An older phone has fewer of these defences. Keep some storage free, since a full phone fails installs and updates in confusing ways.

Data, battery, notifications and tracking

Live-dealer video consumes data continuously; slots mostly on first load. A bright screen and mobile data are the main battery costs. An app that drains the battery while closed, or uses data in the background when you have not opened it for days, deserves a look at its permissions and background activity settings. Notification permission is optional on Android 13 and later, and declining it removes the promotional alerts without affecting play. Apps typically collect a device identifier and advertising ID for fraud prevention and campaign measurement; the advertising ID can be reset or deleted in privacy settings.

Troubleshooting table