Spotting a Cloned Website Before You Log In

Imitation sites copy the look of a real one exactly. The address is the one thing they cannot copy.

How the trick works

Phishing is the practice of deceiving people into revealing sensitive information, often through a counterfeit website reached by a link in a message. See Wikipedia's article on phishing. The page design, logo and wording are lifted from the original, so appearance tells you nothing.

Read the address from the right

The part that matters is the registered domain, immediately before the first single slash. In secure.example.com.login-check.net/account the site is login-check.net. Everything to the left is decoration chosen by the attacker.

Small substitutions

• Letters swapped for look-alikes: a capital I for a lowercase l, a zero for an O.
• Extra words: -support, -verify, -official.
• A different ending: .co or .net where the real site uses .com.

What the padlock means

A padlock shows that the connection is encrypted. It says nothing about who is at the other end. Imitation sites have padlocks too.

Habits that work

1. Reach important sites from your own bookmark, not from a link in a message.
2. Let a password manager fill the login. It will not fill on the wrong address.
3. Treat urgency as a warning. Real services rarely demand action within minutes.
4. If unsure, close the page and contact the service through a number you already have.

If you have already entered details

Change the password immediately from the genuine site, sign out other sessions, and tell your bank if payment details were involved.