Account takeover intercepting magic link for Arrive app

The "magic link" used for login by Arrive app uses Branch.io to pass the login token via deeplink to the app. But the URL contained in the link (app.link domain) is not verified so it can be intercepted by a malicious app at takeover the account.

<intent-filter>
	<action android:name="android.intent.action.VIEW" />
	<category android:name="android.intent.category.DEFAULT" />
	<category android:name="android.intent.category.BROWSABLE" />
	<data android:scheme="https" />
	<data android:host="qvay.app.link" />
</intent-filter>