Casino App Safety: The Two Android Permissions That Matter Most

On this page

• What "display over other apps" actually allows
• What an accessibility service can do once granted
• How to audit both on your own phone, right now
• The full permission list with a verdict on each
• Why real-money casino apps are not in Google Play or the App Store here
• What an APK is, and what hand-installing costs
• Why permissions can reappear after an update
• A pre-install checklist
• iPhone: a shortcut instead of an app, and no permissions at all
• Storage, memory and Android version in general terms
• Data and battery
• Notifications and tracking
• Troubleshooting the five common failures
• What JILISUPER is and is not

"Display over other apps", in plain terms

This permission exists for legitimate reasons — chat heads, floating video players, screen recorders. What it means technically is that an app may draw its own window on top of whatever else is on screen, including an app you opened yourself.

Turned to a hostile purpose, it produces the overlay attack. You open your e-wallet, the hostile app notices and instantly draws a pixel-accurate copy of the wallet's PIN screen over the real one, and you type your MPIN into the copy. Nothing looks wrong, because you are looking at the right app with the wrong window in front of it. The same trick works on a login form, a one-time-code field or a confirmation dialog, where a tap you believe is cancelling is actually approving.

No gambling function requires it. A casino app does not need to float above your banking app, and a request for it is a reason to cancel the install rather than a detail to skim past.

Accessibility services: the most powerful thing you can grant

Accessibility exists so that screen readers and switch-access tools can help people who need them. To do that job, a service must be able to read everything displayed and to act on your behalf — tap, scroll, type, dismiss. That is an enormous capability, and Android grants it per app on an explicit opt-in.

Granted to a hostile app, it collapses most of your other protections at once. It can read text inside other apps, including codes and balances. It can fill in and submit forms. It can grant itself further permissions by tapping the buttons in the system dialogs faster than you can read them. And it can hide what it did. This is why a persuasive request to "enable accessibility so the app runs smoothly" is one of the clearest danger signals on Android — there is no performance reason for it.

Audit your own phone now

1. Open Settings and search for "accessibility". Look at the list of downloaded or installed services, not the system ones, and turn off anything you do not recognise or did not deliberately enable.
2. Search Settings for "appear on top", "display over other apps" or "draw over other apps". Review the allowed list and revoke everything that is not a chat, recorder or player you chose.
3. Search for "notification access" or "device & app notifications", and remove anything unfamiliar — this permission lets an app read every alert, including one-time codes.
4. Search for "install unknown apps" and switch it off for every browser and file manager that has it.
5. Search for "device admin apps" and remove anything you do not recognise; this one can resist uninstallation.
6. Check battery-optimisation exemptions and revoke the ones you did not intend, since a resident app is a more useful app to an attacker.
7. Repeat this audit after any phone update or app update, because a few of these can be re-requested.

If you find something you do not recognise holding accessibility or overlay permission, revoke it first and uninstall second — in that order, because the permission is what lets a hostile app interfere with its own removal. Then change your wallet, email and casino passwords and check your wallet for transfers you did not make.

The whole permission list, with verdicts

Why the real app is not in the store

Google and Apple both restrict real-money gambling apps to approved countries and require licence documentation tied to a named company per market, after a long review. The Philippines is not treated identically by the two platforms, so a store search here returns social-casino titles, free-coin slots, demo games and imitators rather than a cashier.

The absence is ordinary. What it creates is a market where "nothing real is in the Play Store" excuses every install request, including the ones that come with the permissions described above. That is the reason this page spends its length on permissions rather than on where to find a file.

What an APK is, and what the store was doing

An APK is Android's installer package — code, artwork, and a manifest listing the permissions the app will request. The Play Store downloads the same format invisibly. The format is unremarkable; the loss is in the services around it. Hand-install and you give up developer verification, automated malware scanning, a signing chain that forces later versions to come from the same publisher, automatic updates, and any refund or takedown route.

The icon and app name are declared by whoever built the package, so neither proves anything, and the most effective fake is the real app repackaged with an extra component — which is also the variety most likely to ask for accessibility or overlay access shortly after you start using it.

Why permissions come back

People assume a refusal is permanent. It is not. An app can request a permission again later, and an update is the natural moment to do it, when you are tapping through dialogs to get back to what you were doing. Android also resets some permissions for apps you have not opened in a while, and a prompt after that reset looks like a routine re-authorisation rather than a new request.

So the audit above is not a one-off. Run it after any major update, and treat a request that arrives mid-session — "enable this for better performance" — with more suspicion than one at install time, because the mid-session request is the one that does not need to get past your initial scepticism.

Before you install

1. Consider the mobile browser first: it runs these lobbies, keeps the store's security model, and cannot hold accessibility or overlay permission.
2. Key the domain in manually and read it back letter by letter.
3. Check that a specific company is named in the terms, with a regulator alongside it.
4. Reach any app page from inside that site; refuse anything on a file-locker or shortened link.
5. Read the permission list and cancel on accessibility, overlay, notification access, SMS, contacts, call log or device admin.
6. Leave Play Protect running; a page asking you to turn it off has told you what it is.
7. Remove the installer file and withdraw the unknown-apps permission before the day ends.
8. Decide a deposit ceiling and set it in the account before any money moves.

iPhone: no permissions to get wrong

On iOS there is usually nothing to install. The "app" is a Safari web shortcut: open the site, tap Share, choose Add to Home Screen, and you get an icon that opens the site full-screen. Nothing is installed, no system permission is granted, and iOS has no equivalent of a third-party accessibility service or a free-floating overlay for an app to abuse. Apple's sandbox stays in force, and the shortcut is always current because it loads the live site.

Its one weakness is the hidden address bar: in a full-screen window you cannot see which domain you are on. Build the shortcut from a URL you typed yourself, and refuse any request to install a configuration profile, an enterprise certificate or a TestFlight build — those are the iOS equivalents of the permissions this page warns about, and no working lobby needs them.

Storage, memory and Android version

In general terms a build downloads small and grows for weeks, because game art and audio are cached as you open titles. Judge the footprint by the app's storage entry a month in rather than the quoted download size, and keep a comfortable free margin — a near-full phone shows slow loads and failed updates long before it explains why. Clearing cache is safe; your balance lives on the operator's servers.

Memory matters more than processor speed: live video plus a chat app plus a browser full of tabs is what makes a modest phone reload the lobby on every switch. For Android version support, trust the operator's own help page for its current build, because very old versions tend to stop working after an update rather than being warned in advance.

Data and battery

Live dealer tables and game shows cost the most in both, because continuous video keeps the screen lit, the radio busy and the decoder working at once. First launches and updates are large one-off downloads. Fishing and arcade titles sit in the middle, slots are cheap per spin after loading, and cashier or history pages are negligible. Do updates on Wi-Fi, keep live tables on Wi-Fi, and check your phone's per-app data screen after a week. A hot phone with slowed animations is thermal throttling, not a fault — and playing while fast-charging is the fastest way to get there.

Notifications and tracking

Keep the transactional and security alerts: withdrawal approved, deposit credited, verification complete or rejected, and login from a new device. Silence the promotional categories, which are worded and timed to restart a session you had already ended. Keep them separate rather than switching everything off, because the switch that stops a reload offer often stops the new-device warning too. And note the distinction from earlier: the app's permission to SEND you notifications is ordinary, while permission to READ your notifications is one of the dangerous ones.

An installed build also sees more of your device than a browser tab does and logs what you played, when and at what stakes to aim offers at you. Resetting your advertising identifier and declining optional analytics help a little; the browser helps more.

Troubleshooting

Only the operator holding your balance can act on anything involving money. This guide has no account access, and anyone who messages you offering to fix it is not offering to fix it.

What JILISUPER is, and is not

An independent guide to slots, RTP, jackpots and payment methods. Not a casino: no deposits, no games, no balances, no cashier, no ability to approve or release anything. Some outbound links may be partner links, which changes nothing about what any page says. Gambling is for adults aged 21 and over, and the deposit limits and self-exclusion tools on your operator account exist for the moment play stops being a free choice.