What do you need to understand first?
A familiar icon does not prove an app is genuine. Follow independently found documentation, keep the phone updated and use its screen lock. A login-only custodial app follows a different recovery process from a self-custody wallet.
What might this look like?
A search result leads to an app with the expected name. Instead of trusting the result, you compare the publisher and download route against independently located documentation. A message offering to finish setup for you is a reason to stop.
Where is the safety checkpoint?
How can you work through it?
Prepare the phone
Use an updated device you control, with a screen lock. Avoid setup while someone can watch or record the screen.
Check the installation route
Find the genuine documentation independently. Compare the publisher and source; do not use a link from unsolicited support.
Confirm who holds the keys
Read whether the setup is custodial or self-custody. Do not assume an app password is a wallet backup.
Record the documented recovery information
For a phrase-based setup, write it offline in exact order. Do not photograph it, send it to support or enter it into a website.
Check before receiving
Use the documented backup check without erasing access. Read the receiving asset and network, then learn the small-test process.
When should you pause?
Can you open the wallet privately, explain its recovery and find the correct receiving details? Stop if the source, backup or custody model is uncertain.