Phishing & messages
How can I recognise a fake login page?
Check the hostname carefully, watch for urgency and odd design details, never reuse passwords from unexpected links, and open the real site yourself instead of clicking through.
What this means for you
A padlock and logo are not enough. Fake login pages exist to steal passwords and one-time codes—treat unexpected sign-in prompts as suspicious.
Detailed explanation
Phishing pages copy colours, logos, and form fields. The reliable tell is often the URL: misspellings, extra hyphens, or unrelated domains.
HTTPS does not prove identity. It only means the connection is encrypted to that host.
Unexpected password resets, “confirm your account” messages, and QR codes that open login forms are common delivery paths.
When unsure, close the page and navigate to the service via bookmark or official app.
Warning signs and signals
- Login links from unexpected SMS, email, or DMs
- Domains that almost match the brand
- Pages asking for password plus card or ID “verification”
- Pop-ups that overlay a real site after a malicious redirect
Practical verification steps
- Inspect the full hostname before typing anything
- Use official apps or bookmarks for sensitive accounts
- Enable passkeys or 2FA so a stolen password is less useful
- Scan suspicious login URLs with Fraudly before interacting
What Fraudly can and cannot verify
Fraudly cannot see whether you already typed a password.
If you entered credentials, follow the after-incident guidance and change them from a clean device.
Key trust concepts
HTTPS does not prove legitimacy
HTTPS encrypts the connection. It does not prove who runs the site or that the offer is genuine.
Verified identity and trustworthy behaviour are different
Knowing who someone claims to be is not the same as knowing they will treat you fairly.
Related guides
Reviewed: 8 August 2026
This page is educational decision support. It is not legal, financial, or emergency advice.
