SkanIs CamScanner safe to use?
There is no known malware in CamScanner’s iPhone app today. The 2019 scare was about the Android app: Kaspersky found a malicious module in a third-party advertising library, Google removed the app, and CamScanner took the library out. What’s left is a privacy choice. CamScanner’s App Store listing says it uses identifiers and usage data to track you, and it sells a Premium subscription with cloud features. If you’d rather your documents never leave the phone, use the iPhone’s own scanner in Files or Notes, or an offline scanner such as Skan.
What happened in 2019
On 27 August 2019, Kaspersky reported that recent versions of CamScanner for Android on Google Play contained a malicious module, which it detected as Trojan-Dropper.AndroidOS.Necro.n. It sat in a third-party advertising library and could download and run more code from the attackers’ servers. Google removed the app from Google Play.
CamScanner’s notice to Android users says the module came with an advertising SDK from a company called AdHub in Android version 5.11.7, that it found no sign of document data leaking, and that a cleaned-up version was back on Google Play. It also said it would temporarily remove all advertising SDKs from both the iOS and Android apps for a security check. Kaspersky’s report was about the Android app; it didn’t describe a problem in the iPhone app.
Why India blocked it
On 29 June 2020 India’s Ministry of Electronics and Information Technology blocked 59 apps, CamScanner among them, citing reports of apps sending users’ data to servers outside India without authorisation. The order was part of a wider block of Chinese apps and didn’t name a specific finding about CamScanner. CamScanner is made by INTSIG Information Co., Ltd., based in Shanghai.
What the iPhone app collects today
Every App Store listing has an App Privacy section written by the developer. CamScanner’s lists Data Used to Track You: identifiers and usage data, which may be used to track you across other companies’ apps and websites. It also lists data used for third-party advertising. The app has Premium in-app purchases and offers uploads to cloud services. None of this is malware, but it means more than a camera and a PDF.
How to judge any scanner app
- Read the App Privacy section on its App Store page. “Data Not Collected” is the best answer.
- Turn on Airplane Mode and scan. If text recognition still works, it runs on the phone.
- Check whether it asks you to create an account before you can scan.
- Look for ads and tracking in the free version. Ads usually mean an advertising SDK in the app.
- Check that you can export a normal PDF without a watermark.
Scanning without uploading
For the odd page, the iPhone’s own scanner is enough: here’s how to scan documents to PDF with Files or Notes. If you scan a lot, Skan is free and keeps everything on your iPhone. Its App Store listing says “Data Not Collected”. There’s no account, no ads and no server. Text recognition happens on the phone, PDFs come with a text layer you can search and copy, and receipts get their total, VAT and date read out for a CSV export.