I have a payment application in my device, my application connect to that application's service to get a pending-intent for launch payment activity and then listen to result in onActivityResult() method.(similar to In-App-Purchase scenario)

I set package name for payment intent. but you know, it's not guarantee payment application is trusted. if some one install fake application through unknown source with same package name and same aidl-service implementation then it can give me pending-intent and phishing my user info.

*I verify payment result with some mechanism and that only safe my application from fake payment result but my application user enter their data in phisher application.* (this paragraph say my problem is not trusting response of payment application, **my problem is trusting payment application before launch their activity**)

I know some approach that i can check other application signature and public key. **if** Android OS **guarantee that public key and signature is read-only and matched for installed application**, i can rely on that and check public key of payment application before sending intent to that.but i guess those is not ready-only and check match only in installing.

any suggestion (similar or different approach) for prevent phishing attack ? 

**Updated**:
about 50% of application's user install application from my corporation website directly (Unknown-Source).