5 reliable ways to tell a fake sign‑in page from the real one

The real goal of most phishing emails is a sign‑in page. These pages copy the logo, colours and wording of the service they imitate, one to one. So signs like “the design looked slightly off” are no longer reliable. As the magnifier on our home page shows, a fake page gives itself away not by how it looks, but by what is behind it.

1. Trust the address bar, not the look

The one thing a fake page cannot change is the domain your browser shows in the address bar. Read it from right to left:

• In mailcloud.com.secure-login-verify.top, the real domain is secure-login-verify.top.
• Addresses like login-microsoftonline.co add a word or a different ending to the real brand.
• Long, cryptic paths push the real domain out of view. On mobile, tap the address bar to see the full address.

2. Know what the padlock means

For years the advice was “see the padlock, you’re safe”. Today that is misleading. The HTTPS padlock only confirms that the connection between your browser and the server is encrypted. It says nothing about who owns the server or whether it can be trusted. Thanks to free certificates, most phishing sites show a padlock too.

3. Use your password manager as an early warning

Password managers only autofill a saved password on the domain it was saved for. If a sign‑in form that always fills automatically suddenly stays empty, treat it as an alarm: you are very likely on a different domain. Don’t copy the password in by hand; check the address first.

4. Open sign‑in pages from bookmarks, not links

If a link in an email, text or chat takes you to a sign‑in page, don’t use it. Always reach company portals, your bank and cloud services through your own bookmarks or by typing the address. If something genuinely needs your attention, you’ll see it in your account after signing in.

5. Don’t think “MFA is on, I’m safe”

Multi‑factor authentication (MFA) makes stolen passwords largely useless and should always be on. But advanced Adversary‑in‑the‑Middle (AiTM) phishing kits place the fake page between you and the real sign‑in. When you enter your password and your SMS or app code, the attacker relays both in real time and captures the resulting session cookie.

So if a page unexpectedly asks for a code, or approval prompts arrive one after another, don’t approve and report it. For organisations, the strongest protection is phishing‑resistant authentication such as passkeys and FIDO2 security keys: they are bound to the real domain and do not work on a fake site.

If you entered details on a fake page

1. Tell your security or IT team immediately.
2. Change the password on the real site, and on any other account that uses the same password.
3. For company accounts, ask IT to end active sessions. In AiTM attacks, a password change alone does not always close a hijacked session.

Short checklist for organisations

• Make MFA mandatory for company accounts; move admins and critical roles to phishing‑resistant methods.
• Monitor look‑alike domains (typosquatting) and detect sites imitating your brand early.
• Add fake sign‑in scenarios to phishing simulations, and measure not just clicks but data entry and report rate.

Frequently asked questions