Use HTTPS, check the domain carefully, keep Android security protections enabled, and avoid unknown mirror files. Never disclose passwords, OTPs, or recovery codes to someone claiming they need them for support.

Recommended reading