The fake login page is the workhorse of online fraud: a pixel-perfect copy of your bank, your email or your office portal, waiting at the end of a convincing link, harvesting passwords from people who did everything almost right. What saves you is not vigilance in the abstract but a checklist — because fake pages, however polished, cannot fake everything. Learning how to spot a phishing page means learning the handful of tells that survive every costume: the address, the certificate, the context and the pressure. This guide gives you the checks in the order to run them, in the seconds before you type anything.
Tell One: The Domain Is Wrong (It Always Is)
A phishing page can copy logos, layouts and language perfectly, but it cannot live at the real address — so the address is where you look first, and it deserves a full, slow read. Read the domain from the right: in secure-login.bank-example.com.attacker-site.net, the real domain is attacker-site.net and everything before it is decoration. Attackers exploit every reading shortcut: lookalike letters (paypa1, arnazon, micros0ft), extra words (bank-secure-login.com), real brands in subdirectories of random sites, and link shorteners that conceal the destination entirely. One more modern variant deserves a name: QR-code phishing, where the fake link arrives as a code on a poster, a parking meter or in an email image — treat every QR code that asks for credentials with the same suspicion as a shortened link, because that is precisely what it is. The defence is a habit, not an inspection: never arrive at a login from a link in a message; navigate there yourself — typed address, bookmark, or the official app — and let the page prove nothing, because you brought yourself to it. On mobile, where address bars truncate, the habit matters even more: open the app, not the link.
Tell Two: Pressure, Secrecy and the Wrong Channel
Phishing is theatre before it is technology, and its script never changes: urgency (“your account closes in 24 hours”), fear (“unusual sign-in detected — verify now”), greed (“unclaimed refund”), and secrecy (“do not discuss this”). Legitimate institutions communicate through their own channels and survive your taking an hour to verify; fraud requires you frightened and fast. Notice the arrival channel’s improbability: banks do not send login links by SMS to numbers they never had, employers do not move payroll verification to a personal email, and delivery companies do not need your card password to reschedule a parcel. When a message creates a racing heart, treat the feeling itself as the detection signal — it was engineered — and verify through an independent route: the official app, the number on your card, a call you initiate. The scammer’s entire budget is spent defeating your thirty seconds of calm; spending them is the countermeasure.
Tell Three: The Page Behaves Slightly Wrong
Under the copied paint, fake pages are typically shallower than the real thing. Links at the page’s edges (help, about, legal) often lead nowhere or back to the same login; language errors hide in the secondary text the copiers did not proofread; images may be slightly off-resolution; and the page’s one functional obsession is the credential form itself — everything else is scenery. Technical tells reinforce: the padlock only proves an encrypted connection to SOMEONE (phishing sites have certificates too — the lock means the pipe is private, not that the destination is honest), and password managers provide the sharpest test of all — they fill credentials by exact domain match, so a manager that suddenly refuses to autofill on a “familiar” page is telling you the address is not the one it knows. Heed it. This layered suspicion — address, story, behaviour — is the same detection philosophy that anti-cheat systems use in games and that our companion piece describes for feeds in how recommendation algorithms work: systems reveal themselves in the details they could not afford to fake.
If You Already Typed: the Damage-Control Sequence
Mistakes happen to careful people; what separates a scare from a loss is the next fifteen minutes. From a clean device or the official app: change the password on the real site immediately, then change it anywhere the same or similar password was reused (this incident is why unique passwords exist). Turn on or re-verify two-factor authentication, and review the account’s active sessions and recent activity for strangers. If banking details were entered, call the bank’s fraud line — the number on the card, dialled by you — and follow their freeze and monitoring advice. Report the page (browser’s “report phishing” option, your organisation’s IT or security contact, the impersonated company) so the next target’s browser may already block it. Then forgive yourself efficiently: these pages are built by professionals to defeat professionals, and the lesson purchased is a permanent one.
Making Your Household Phish-Resistant
Individual checklists scale into systems. Password manager for everyone — its autofill discipline is a structural defence, not a convenience. Two-factor on every important account, preferably app- or key-based rather than SMS. Updates installed, because browser phishing filters improve constantly. A family code word or verification habit for urgent money requests, since the same theatre now arrives by voice and video. And a norm worth stating aloud to the people you love: no legitimate urgency punishes verification — anyone, including this household, who demands instant action without independent checking is to be slowed down, lovingly and absolutely. Knowing how to spot a phishing page is finally not a technical skill at all; it is the habit of reading the address, distrusting the adrenaline, and arriving at your accounts by roads you chose yourself. The fake page can copy everything except your route to it — so choose the route, every time.
