They can't. If "no phishing" is a desired property, then it would be up to the distribution ecosystem to either carefully monitor for such products and deny them, or to at least allow some mechanisms for users to verify products themselves (such as SSL combined with URL bars do for general web traffic).
Comments
This is not possible. You should design your architecture so that this either does not matter or has a bounded cost.
Had a hunch this was the case, just needed someone smarter than I to confirm.
How do banks ensure nobody makes a phishing version of their apps?
They can't. If "no phishing" is a desired property, then it would be up to the distribution ecosystem to either carefully monitor for such products and deny them, or to at least allow some mechanisms for users to verify products themselves (such as SSL combined with URL bars do for general web traffic).