Is my suggested approach cryptographically secure?
Indeed, an attacker will look at your implementation and exploit the fact that you're relying on a PRF that the attacker can access. You would at least need to separate the PRF from the rest to be secure. Especially, since you state that you would be feeding a unique user-id to the PRF during your (let's just call it) “authorization process”. If we assume that the unique key doesn't change, we're somewhat shifting towards a key-reuse problem too, which opens up additional attack vectors; especially with your example implementation. But I won't go into too many details as that would quickly become too broad. Short story is: you’re correct – your described implementation is not secure… at all.
What other, better or simpler approaches could I take to solving this problem?
Potential solutions could easily be found in public key cryptography. Or, you could try to rely on an authorized data-exchange with a webserver using a secured HTTPS connection so that the server provides the PRF functionality, but that's less secure and I'm not really sure if it would actually satisfy all your cryptographic needs.
Personally, I would advise to go for public-key crypto when it comes to a communication app like you describe it in your question, because it's the usual way to handle the situation/functionality you describe. It may sound a bit boring, but there's no need to reinvent the wheel as long as well-vetted options are available. Especially, if your cryptographic knowledge isn't (at least) on a professional level. And even then, pros will tend to go for tested crypto-implementations instead of trying to create their own crypto-solution. Chances you're messing things up (like the PRF you're relying on would be shared with attackers) is too big to take… a minor flaw in your crypto can quickly grow into a 100% insecure app.
Now, you didn't mention any programming language, so I can't point you to any specific direction, but public-key solutions (libraries etc.) are available for almost any programming language. It should be easy to find something appropriate for your purposes. And if any question related to public key crypto itself arises along the way, please feel invited to post another question here as Crypto.SE.