A match sends an app-install link outside the store

Why an off-store install link is a stop signal

When a match asks you to install a file rather than pointing you to a store listing you can inspect, the request is unverified. The FTC notes that phishing messages try to obtain sensitive account or financial information and advises reaching a provider through a website or phone number you know independently rather than through a suspicious message. Applied here: do not use any link in the message; find the store yourself. Declining a file is a security step, not an accusation about the person. [FTC: How To Recognize and Avoid Phishing Scams]

• Do not tap, download, sideload or install the sent file.
• Screenshot the message, then close the thread for now.
• Write down only the claimed app name and stated purpose.

Verify the app through its official store

Open the store directly rather than following a supplied link, then search the exact app name. Compare the developer name, listing description and stated purpose with what the message promised. A real listing describes an app; it does not verify the sender or make an off-store file acceptable. If the app is not listed, the sent file stays declined. If a listing exists but its purpose differs, the sent file still stays declined. This is a check on the app claim only.

• Type the app name into the store search bar yourself.
• Compare developer name, icon and description with the message.
• If the app is absent or the purpose differs, decline the file.

Checking one narrow public-profile clue

Limit the check to a single claim visible on the public profile: whether the claimed app name appears in the public bio. Do not follow links from the profile, request passwords or screen-sharing, or seek private access. A matching name in a bio shows only that the name appears publicly; it does not confirm that the app exists, that the file is safe, that the sender is the developer or that the profile owner sent the message. Do not read a delayed response, an old screenshot, a matching username or a refusal to answer as evidence of intent or honesty. Stop once you have your answer.

• Pick one claim to check: the claimed app name as shown publicly.
• Note what matched and what remains unverified.
• Do not use the clue to infer intent, character or identity.

A practical comparison worksheet

Use a side-by-side sheet before replying. Column one records the observation: what the message claims. Column two records the limit: what the store listing or public profile actually shows, and what it cannot show. Column three records your action. This is an editorial worksheet, not a test of a person, and any mismatch is a reason to decline the file, not proof of wrongdoing.

Hypothetical worked example

Suppose a match writes, "Here's the installer, the store version is outdated," and attaches a file. You do not open it. You search the app name in the official store, find a listing described as a photo editor, and note the message claimed it was for private messaging. You check one public clue: the app name appears in the public bio. That match only means the name is shown publicly; it does not verify the sender, and the stated purpose still differs. You reply that you install only from the store and return to the previous topic. If the request repeats or pressure increases, you can stop contact and report the profile. This is an illustration, not a script for judging the person.

• Use neutral wording: "I only install from the store."
• Keep the conversation in the existing app or platform.
• Stop replying if the request repeats or pressure increases.

Account protection without new access

You can protect accounts without touching the file. The FTC notes that multi-factor authentication adds account protection, so consider enabling it where available. Do not share one-time codes with your match, and let no link decide which store or login page you use. [FTC: How To Recognize and Avoid Phishing Scams]

• Consider turning on multi-factor authentication where available.
• Do not share one-time codes.
• Choose the store or login page yourself, never through a link.

When to stop and what to do next

Set a stopping rule in advance: if the app cannot be found in the official store, or the claimed purpose differs from the listing, decline the file and pause the conversation. Stopping contact is a normal boundary, not a verdict on the person. If the person pushes or sends another file, stop contact and report the profile, as the IC3 advises for suspicious profiles and suspicious contact. If you shared payment information or entered card details on a lookalike site, contact your card issuer or bank promptly about suspected fraudulent transactions. For money already sent, contact the payment provider and report; further profile searches cannot recover funds. [FBI/IC3: New Verification Schemes Target Users of Online Dating Platforms] [FTC: What To Do if You Were Scammed]

• Decline the file when the app is absent or misdescribed.
• Report the profile if the request repeats or escalates.
• If card details were entered or money sent, contact the card issuer or payment provider and report.

Keeping future install requests simple

Make store-first a standing habit: before installing anything a match suggests, find the app yourself, read its listing, and compare its stated purpose with the message. Keep verification to public material and one specific claim, then stop. If the app is not in the store, the answer is no. Treat that as a limit on verification, not a judgment about someone's character; one public clue will not identify a person or confirm activity.

• Search for the app yourself; do not use message links.
• Compare the claimed purpose with the listing.
• Treat a missing listing as a reason to decline, not proof of intent.

A couple more questions