How to tell if a website is fake

Phishing pages are often good copies. A familiar logo, tidy design, and working sign-in form tell you very little about who is running the site. The address and the reason you were sent there are much better clues.

If a page feels wrong, stop before typing anything. You can check the real service separately without finishing whatever the page asked you to do.

Did you open the page from an unexpected email or message? Were you told that an account would be closed, a payment had failed, or a prize was about to expire? That pressure is often the point. It gives you less time to notice where the link actually goes.

Open the company’s app yourself, use a bookmark, or type the address you already know. If the warning is real, it should normally appear there too. The FTC gives the same advice: contact the company using a website or phone number you know is genuine.

Check the web address

Look at the domain in the browser’s address bar. A company’s name can appear almost anywhere in a URL without the company owning it.

Take accounts.example.com, which belongs under example.com. By contrast, example.com.signin.example.net belongs under example.net, despite the familiar name at the beginning. The address example.net/example.com is also on example.net; the part after the slash is only the page path. These are made-up examples using domains reserved for documentation.

Watch for swapped letters, unexpected extra words, and link shorteners that hide the destination. Domain endings do not all follow one simple pattern, so avoid relying on tricks such as counting dots. If you cannot confidently identify the real domain, leave the page and reach the service another way.

HTTPS protects the connection between your browser and the website. It does not tell you that the site belongs to the company shown on the page. Phishing sites can use HTTPS too.

Chrome’s security team explains this distinction in its write-up on browser security indicators. Browser warnings are useful when they appear, but a page is not automatically safe just because there is no warning.

A legitimate support worker should not need your password, wallet recovery phrase, or one-time login code. A normal verification page should not tell you to paste a command into your computer or install an unfamiliar program. A Discord QR code is a login approval, not a harmless way to claim a gift.

Do not enter fake details to test a suspicious form. You may still be giving the site useful information, and interacting with it can lead to downloads or further prompts.

When you are unsure, keep the original URL and report it to us. Tell us where it came from and what the page asked for. You can do that without reopening it.

If you already used the page, go straight to the steps for securing your account or device.