Principle

A login screen is only as safe as the page hosting it

You're about to enter a username and password into a page you reached from an email, text, ad, or search result.

The page can look exactly right and still be a copy. The logo, the colors, the layout. What it cannot fully fake is the address at the top of the browser. Look for the real domain. Watch for extra words, swapped letters, or unusual endings (.co instead of .com, paypal-secure.com instead of paypal.com).

Easier rule: do not log in through links. Type the address yourself or use your saved bookmark. Your password manager is also useful here. It will refuse to autofill on a fake site, because it knows the real address and the fake one is not it.

Scams this applies to