Start with the publisher, not the icon
App icons are trivial to copy. Publisher identity is not.
Before installing anything claiming to be an exchange app, confirm who publishes it. On Google Play the developer name is shown directly under the app title; on the official website the download link should resolve to the exchange's own domain, not a file-hosting service.
Android installation
Through Google Play
Open the store listing, confirm the developer, then check that the review history spans several years. A listing with thousands of reviews concentrated in the last few weeks is a strong warning sign regardless of the star rating.
Through the official APK
Where the store is unavailable, the official site provides an APK. After downloading, verify the SHA-256 hash against the published value.
This takes under a minute and is the single most effective anti-tampering check available to an end user.
iOS installation
The app is distributed via the App Store and availability follows your Apple ID's region. If you cannot find it, changing your physical location will not help; the account region is what matters.
Avoid third-party iOS marketplaces entirely: builds installed that way lose code-signing guarantees.
Frequent installation problems
Download stalls near completion
Usually a network interruption rather than a server fault. Switch from mobile data to Wi-Fi or the reverse, and clear the browser cache before retrying.
Install button greyed out on iOS
Insufficient storage in most cases. Check available space; the app plus its data cache needs more room than the download size suggests.
App installs but crashes on launch
Check the minimum OS version. Older Android builds below the supported API level will install and then fail immediately.
Play Protect warning on Android
Expected for APKs from outside the store. Verify the hash first.
If it matches, proceed; if not, delete the file.
First-run security setup
Turn on two-factor authentication immediately, preferably with an authenticator app rather than SMS, since SIM swapping defeats SMS-based codes. Set an anti-phishing code.
Review the device management list and remove anything you do not recognise. Enable withdrawal address whitelisting before your first transfer.
What genuine support will never do
Support will not ask for your password or two-factor code, will not request remote access to your device, and will not ask you to move funds to a "safe wallet" for verification. Any message that does is an impersonation attempt, regardless of how official the sender looks.
