Establish the distribution chain
Save the official service page that links to the store or download, then capture the store publisher and package identity. Avoid search ads and QR codes from unaffiliated pages.
This page is a decision worksheet built around a specific search task. It separates observable records, first-party wording and unresolved claims so the conclusion can be checked again after a material change.
Inspect account destinations
Record hostnames opened for sign-in, registration, verification and cashier tasks. Explain every domain change before entering credentials or identity documents.
Protect authentication secrets
Use a unique password and supported two-factor authentication. Support should never collect a password, email code, authenticator code, recovery code or wallet seed.
Check transport and device hygiene
Keep the operating system, browser and app current; avoid rooted or jailbroken devices for payment tasks and do not authorise unknown certificate or accessibility profiles.
Prepare incident evidence
Record version, device, timestamps, account references and exact errors without exposing secrets. Revoke sessions and secure the registered email first after an unknown login.
A polished app can still connect to the wrong business
Treat branding as presentation and treat publisher, package, legal entity and payee as identity evidence. If these records diverge, stop before depositing or uploading documents and request a written explanation through a separately verified support route.
Questions this page resolves
Does HTTPS prove the app is genuine?
No. It secures a connection to a domain; it does not establish the intended operator.
What is the most dangerous support request?
Requests for passwords, live one-time codes, wallet seeds or remote-control access require an immediate stop.
How often should the security check be repeated?
Repeat it after publisher, domain, package, update-source or payment-recipient changes.