How to Recognize Phishing Websites

Phishing is a trick: someone builds a message or a website that looks like a real company, a bank or a colleague and persuades you to hand over something valuable, usually a password, a card number or a one-time code. The page is often a close copy of the real login screen. The only reliable difference is where it lives.

This guide explains the common warning signs, shows a routine for checking a link before you act on it, and covers what to do if you have already entered something. Everything here is practical and takes seconds to apply once it becomes a habit.

How phishing usually reaches you

Most phishing starts with a message designed to make you act quickly:

• Email claiming your account is locked, a payment failed or a parcel is waiting.
• Text messages and chat apps with a short link and an urgent request.
• Search ads and social media posts that lead to a lookalike site of a real brand.
• QR codes on posters, parking meters or in messages that open a fake page.
• Phone calls that ask you to visit a website or read out a code.

The message often uses pressure ("act within 24 hours"), authority ("your bank", "tax office"), or an offer that is too good ("you have won"). The goal is to get you to click before you think.

Warning signs on the page and in the address

Check the domain, the part that matters

The address has a structure. In https://login.example.com/account, the registered domain is example.com, and the part before it, login, is only a subdomain. The attacker controls any subdomain of their own domain, so a fake can look like this:

Real address	Fake address	What gives it away
bank.example.com	bank.example.com.secure-check.net	The real domain at the end is secure-check.net
example.com	examp1e.com	A digit 1 instead of the letter l
example.com	example-login.com	Extra words attached to a brand name
example.com	example.co	A different ending
example.com/login	example.com@evil.net/login	Everything before the @ is ignored, the real destination is evil.net

Always read the domain from right to left up to the first single slash.

Other signals

• A request that does not match the situation. A parcel service asking for card details to "release" a free item is a common pattern.
• Poor design or language. Many fake pages are sloppy, but good ones are not, so a clean page proves nothing.
• Unexpected login prompts. Being asked to sign in again after clicking a link in a message is a red flag.
• Pop-ups asking for sensitive data, or a page that refuses to let you leave.
• File downloads you did not ask for, especially archives or programs.

Why the padlock does not settle it

The padlock shows an encrypted connection and a certificate for the site's own name. Certificates are available to anyone who controls a domain, including free ones from services like Let's Encrypt. A phishing site can therefore have a perfectly valid padlock for its fake name. HTTPS answers "is this connection private and is this really the domain shown?", not "is this the company I think it is?". The difference is explained further in HTTPS vs VPN and in Cloudflare's overview of HTTPS.

A safe checking routine

Run through this whenever a message asks you to log in, pay or confirm something.

1. Pause. Pressure is the tool being used on you. Wait at least a minute.
2. Do not use the link or number in the message. Open the service through your own bookmark, its official app, or by typing the address yourself.
3. Look for the same notice inside your account. Genuine alerts show up there as well.
4. If you must inspect a link, hold the pointer over it on a computer, or press and hold on a phone, and read the full address. Compare the registered domain with the real one.
5. Check the sender, not just the display name. The name can say "Your Bank" while the underlying address is something else.
6. Call the organisation using a number from your card, statement or their official site, not the one in the message.
7. When in doubt, report it. Forward it to your provider's abuse address or follow the reporting options described by CISA.

A worked example

Anna receives a text: "Your parcel could not be delivered. Confirm your address and pay 1.20 to reschedule: https://post-delivery-confirm.example-help.top."

• She has not ordered anything this week, so the situation may not match.
• The domain, read from the right, is example-help.top. It is not the post office's domain. The long text before it is only a subdomain.
• The message creates pressure and wants card details for a tiny fee.

Anna ignores the link. She opens the official courier app, which shows no pending parcel. She deletes the text and reports it. If she had instead tapped the link and typed her card number, the page would simply have sent it to the attacker.

What to do if you already entered details

1. Change the password on the real site straight away, from a device you trust. Do the same anywhere else you used that password.
2. Turn on two-factor authentication if it was off, and sign out all other sessions. See what two-factor authentication is.
3. Contact your bank or card issuer immediately if you entered payment details. They can block the card and check recent transactions.
4. Review recent account activity, forwarding rules in your email and any new devices or recovery details.
5. Scan the device with a trusted security tool if you downloaded a file.
6. Report the page to the real service. Saving the fake address, not opening it again, helps them take it down.

How to reduce the risk in advance

• Use a password manager. It fills in a login only on the correct domain, so a lookalike page gets nothing, which is a quiet but effective warning.
• Turn on two-factor authentication everywhere it is offered, ideally with security keys or passkeys, which are tied to the real address.
• Keep your browser and operating system updated, since built-in warnings improve over time.
• Use bookmarks for banking and other sensitive services.
• Be careful on shared networks, but remember that a VPN does not judge the sites you visit.

Limits and things to watch for

• No sign is perfect. Well-made phishing pages can have a valid padlock, clean design and a believable address. Rely on how you arrived at the page.
• Familiar senders can be impersonated or hijacked. A message from a friend's account may come from an attacker.
• Codes are valuable. Never read out a one-time code to anyone who contacts you. Real companies do not ask for it.
• A VPN is the wrong tool for this. It encrypts your connection, but it cannot tell whether the site at the other end is genuine. See what a VPN cannot protect you from. For more general reading, the EFF Surveillance Self-Defense guides cover phishing and safer habits in depth.

Summary

Phishing works by pressure and imitation, so the defence is slowing down and checking the real domain. Reach services through your own bookmarks or apps, treat unexpected log-in requests with suspicion, never rely on the padlock alone, and use a password manager plus two-factor authentication to shrink the damage if you slip. If you want a way to protect your connection on shared Wi-Fi as well, you can read about VPN use on public Wi-Fi.