So Fortnite is finally coming to Android and instead of just being happy about it I've spent the last week annoyed on behalf of everyone who's about to get scammed.
Quick recap for anyone who's been off the internet: Epic Games confirmed a couple weeks back that Fortnite for Android isn't going through the Google Play Store at all. You'll download it straight from Epic's own site as an APK. Tim Sweeney's been pretty open about why: he doesn't want to hand Google 30% of every V-Buck purchase, and honestly I get it, that cut has always felt steep for a company that's basically just hosting a listing page. Samsung struck a deal to get it first too, so if you preordered a Galaxy Note 9 you've had early access to it since Sunday at their Unpacked event in Brooklyn. Everyone else is still waiting.
And that waiting is exactly the problem. The second Epic said "no Play Store," a swarm of fake "Fortnite Android APK" videos showed up on YouTube. I'm not exaggerating when I say I found six of them in about ten minutes last night, most with six-figure view counts, all linking out to some sketchy download site dressed up to look official. A few wanted you to fill out a "human verification" survey before the download would start. One redirected me through three different ad pages before landing on a page that, near as I could tell, wasn't even hosting an actual file. Security folks have been writing about this for weeks now (Malwarebytes had a good rundown of it) and Google's already had to yank a bunch of fake Fortnite apps that were sitting on the actual Play Store, some of which had been downloaded hundreds of thousands of times before getting pulled.
Here's the part that bugs me. Epic's whole pitch is "we don't need Google's store, trust us instead." Fine, maybe. But bypassing the Play Store also means bypassing Play Protect, the built-in scanning that at least tries to catch this stuff automatically. Sideloading an app on Android means going into Settings and flipping on "Unknown sources," which is a setting that exists specifically to warn you that you're now on your own. Most twelve-year-olds hunting down a free copy of the hottest game on the planet are not reading that warning dialog. They're clicking "OK" as fast as their thumbs will let them.
I don't have a Note 9 (my current phone is a two-year-old Nexus 6P that's basically held together with hope at this point) so I can't even try the real thing yet. But I did spend a chunk of my evening walking my nephew through how to tell a legit download page from a fake one, which is a genuinely weird thing to have to explain to a fourteen-year-old in 2018. Look at the domain. Does Epic actually own it. Is there a padlock. Does the file end in .apk and not .apk.exe or some nonsense like that. He was patient about it, mostly, though I think he mainly wanted me to stop talking so he could get back to Fortnite on his console version.
None of this is really Epic's fault, to be clear. You can't blame a company for other people building scam pages around their announcement. But I do think Epic underestimated how much cover the Play Store actually provides against exactly this kind of thing, even with all its flaws. Say what you want about Google's app review process (and there's plenty to say, it misses stuff constantly), it's still a single place people know to check, and pulling one popular game out of it creates a vacuum that grifters are extremely happy to fill.
The official wider Android rollout is supposedly coming soon for everyone outside the Note 9 exclusivity window, and when it does I'd bet the fake-APK problem gets worse before it gets better, just because the search volume for "fortnite android download" is about to spike hard. If you're the designated tech support person in your family — and if you're reading a blog like this at eleven at night, you probably are — it might be worth a heads up text to whoever in your life is Fortnite-obsessed and under the age of fifteen. Cheaper than explaining a stolen Google account later.