Step 1: Disable install from unknown sources
Before installing, open the device's security settings and confirm that "Install unknown apps" is disabled for your browser and any messaging apps. This is the default on modern Android versions. If you are installing an APK from the operator's official download page, you will need to temporarily enable the setting for the browser; disable it again after the install completes.
Step 2: Open the official download page
Open the operator's official website from a typed URL. Click the link to the app store listing or the APK download page. Verify that the URL matches the operator's documentation before tapping install.
Step 3: Verify the package name
After install, open Settings > Apps and find the app in the list. The package name should match the operator's documentation. A variation is a red flag that you may have installed a phishing app.
Step 4: Review permissions
Open Settings > Apps > Permissions and confirm the app only requests reasonable permissions. Camera access is acceptable for KYC; microphone, contacts and SMS access are red flags.