Phishing websites: how to spot a fake login page

A phishing website is a fake copy of a login page: your bank, PayPal, Microsoft 365, Netflix, Amazon, your e-mail provider or a parcel service. It looks right, it has the right logo, and it's waiting for you to type your password or card number. The moment you press "Sign in", the details go to criminals.

Fake login pages can be very convincing, because copying a website's appearance is easy. What a scammer can't easily copy is the website's address. That's where you catch them.

How people end up on phishing pages

Almost nobody finds a phishing page by accident. You get sent there:

• E-mails saying your account is locked, a payment failed, or someone logged in from a new device
• Text messages about parcels, toll charges, tax refunds or bank security checks (see our guide to parcel delivery scam texts)
• Messages on WhatsApp, Instagram or Facebook, sometimes from a friend's hacked account
• Search ads that imitate a bank or a crypto wallet and appear above the real result (a favourite trick of crypto scams)
• QR codes on posters, parking meters or letters

The message always creates a reason to act now: a deadline, a threat or a reward.

The one check that matters most: the domain

The address bar shows the real domain. Read it from right to left, starting just before the first single slash. The last two parts (or three, for endings like .co.uk) are the real owner.

Everything to the left of the real domain is chosen freely by whoever owns it. Scammers love putting a brand name there because people read from left to right and stop early.

Common tricks to watch for:

• Swapped letters: rn for m, vv for w, 1 for l, 0 for o
• Extra words: login, secure, verify, support, account, update
• Different endings: .co instead of .com, .info, .top, .online
• Look-alike characters from other alphabets that are almost impossible to tell apart from normal letters

We explain all of these in Look-alike domains and typosquatting explained.

Other warning signs on a login page

The domain is the decisive check, but these are useful hints:

• You arrived via a link rather than typing the address or using a bookmark.
• Your password manager doesn't offer to fill in your password. Password managers match the exact domain. If yours suddenly "forgets" your bank login, that's a strong warning.
• The page asks for more than a login: full card number, expiry date and security code, your PIN, or the one-time code your bank just sent you. Real banks don't ask for all of that to "verify" you.
• Nothing else on the page works. Links in the menu lead nowhere or back to the same page.
• It accepts any password. Some phishing pages "log you in" with anything and then ask for card details.
• Odd language or a design that looks slightly older than the real site.

What isn't a reliable sign: the padlock. A secure connection only means the connection is encrypted. Most phishing sites have the padlock too, because it's free and takes minutes to set up.

What websurely.com checks on a suspicious login page

When you paste a link into websurely.com, several of our checks are aimed squarely at phishing:

• Security databases: we compare every site against more than a dozen trusted security databases that are updated around the clock. If a reliable source has listed a site as phishing, the score goes up sharply.
• Look-alike names: we look for names that imitate well-known brands and popular websites, including typos, brand names hidden inside longer addresses and look-alike characters.
• Login forms that send data elsewhere: a form whose password field posts to a different domain is flagged.
• Website age: we check how long the website has existed. Phishing sites are often only hours or days old.

Phishing pages often disappear within days, and new ones appear faster than any list can keep up with. So a Low score doesn't guarantee a page is safe, especially if it is a very new website that no database has seen yet. If something feels wrong, trust that feeling. Here's how the score works and where its limits are.

Safe habits that beat phishing

• Don't log in through links in messages. Open the app or type the address yourself, then look for the message there. If your account really has a problem, you'll see it after logging in normally.
• Use a password manager. It won't fill in your password on a fake domain, which makes it an excellent phishing detector.
• Turn on two-step verification, preferably with an authenticator app or a security key. It doesn't stop every attack, but it stops many.
• Never read out or forward one-time codes. Your bank will never ask you for the code it just sent you.
• Bookmark the sites you log in to most.
• Install a browser warning tool. The free websurely.com extension shows a rating badge for every site you visit and can show an optional warning banner on high-risk pages. It only sends the hostname, not the full address or page content.

If you entered your details

Don't panic, but act quickly:

1. Change the password on the real site, by typing the address yourself.
2. Change it anywhere else you used the same password, starting with your e-mail account.
3. If you entered card or banking details, call your bank on the number on your card and ask them to block the card.
4. Check your account for logins, forwarding rules and payments you don't recognise.
5. Turn on two-step verification if it wasn't on already.

Our guide What to do if you've been scammed online covers the full process.

Report the phishing page

Reporting phishing gets pages blocked faster:

• Report it to the brand being impersonated. Most banks and big companies have a dedicated address for this on their security pages.
• In the UK, forward phishing e-mails to the National Cyber Security Centre at [email protected] and scam texts to 7726.
• In the US, you can forward phishing e-mails to the Anti-Phishing Working Group at [email protected] and report to the FTC at reportfraud.ftc.gov.
• Report the page to Google Safe Browsing or Microsoft's unsafe-site reporting so browsers start warning other people.
• Report it on websurely.com so other visitors see a warning on the site's report page.

More options by country are in How to report a scam website. For a shorter introduction to reading links, see Phishing links: what to check before you click.

Check a website now

Got a link you're unsure about? Don't open it to find out. Paste it into websurely.com and see the Scam Score first. It's free and needs no account.