Start with identity, not the filename
A familiar app name or icon can be copied. Review the publisher, package details and source address. If a checksum is published through a trusted channel, compare it using a trusted tool; a matching hash only confirms you have that file, not that the publisher is trustworthy.
Read permissions in context
Permissions should have an understandable purpose. An unexplained request for accessibility control, device administration or unrelated personal data deserves further checking. Do not disable security scanning to make a package install.
Keep recovery options ready
Before replacing an existing app, confirm you can recover the account. Review the download checklist and version information.