Users will often download apps that claim to help them improve their device performance, even when there’s no way that’s physically possible. Even as our devices have gotten smarter, the users haven’t. According to a new report by the CSIS securtu group, 10 million Android users downloaded an app known as “Updates for Samsung” which promised users updates.

The app would not only promise updates it couldn’t deliver, but it would ask users to pony up cash to get updates. They’d also be asked to hand over their card details to the developers themselves in exchange as it didn’t use Google Play’s backend to take payments. To make it even worse, users could also pay for annual updates with $34.99.

It goes without saying hay this is a scam. Ony Samsung and your carrier can determine when your update hits your device. While the app did allow users to download firmware, these downloads would often fail by design. In the same vein, Google really shouldn’t have let this app in the Play Store to begin with. While its app store boasts greater numbers than Apple’s, it does have laxer security,resulting in apps like this slipping through and giving the Play Store a bad name.

Source: CSIS, Coverage: TheNextWeb