pull down to refresh

Is this attack mitigated by checking the destination address?