📝 How to Spot a Phishing Page Before Entering Your Password

Phishing pages stopped being obvious a long time ago. The fake sign-in page you meet today is usually a pixel-accurate copy of the real one — same logo, same fonts, same cookie notice. What gives it away is never the design. It is the address bar, and what the page asks you for.

The checks below take about ten seconds before you type a password, and they are the difference between keeping an account and losing one.

Read the address letter by letter

Most fake pages use a domain that looks almost right: one letter added, two letters swapped, or a familiar brand name bolted onto an unrelated domain. Your eye does not read familiar words letter by letter, which is exactly what the attack relies on. Read the address slowly, and read it backwards from the end.

The part that matters is the name immediately before the final dot. A company name appearing anywhere earlier in the address means nothing at all.

The padlock is not a safety rating

A widespread misunderstanding is that the padlock icon means a page is trustworthy. It does not. The padlock only tells you the connection is encrypted; it says nothing about who owns the page. Certificates are free, so almost every phishing page has one too.

Think about how you arrived

Most attacks do not start on the site. They start in an email, a message or an advert. If you reached a sign-in page by clicking a link, close the tab and go back to the site by typing the address yourself or using your own bookmark. That single habit defeats the large majority of phishing attempts.

Watch what the page asks for

• A real sign-in page asks for your password. It does not ask for your card number, government ID or recovery codes on the same screen.
• Urgency lines such as “your account will be closed within 24 hours” exist to stop you thinking.
• A page asking for your two-factor code may be relaying it to the real site in real time.

Do not click past your browser’s own warning

Modern browsers block known phishing pages and show a full red warning screen. Never click through it. You can confirm which protections your browser currently has switched on with the browser security test.

If you already entered your password

Act quickly but calmly. Change the password on the real site first. If you used that password anywhere else, change it there too — trying a stolen password on other services is the first thing attackers do. Then review the account’s active sessions, sign out any device you do not recognise, and turn on two-factor authentication.

Frequently asked questions

Will antivirus software stop phishing pages?
Some of them. A page registered an hour ago can stay online for a long time before it reaches any blocklist. Reading the address remains the most reliable check.

Does a password manager help?
Yes, and in a way people underuse: it will not autofill when the saved address does not exactly match the page you are on. That silent refusal is a warning worth paying attention to.