Fake login pages

1. A message, ad, or QR code opens a lookalike site.
2. The page copies the real sign-in screen and logo.
3. The form sends your password to the attacker. Typed codes go too.
4. Some kits relay the real sign-in as you type. They keep the session cookie that comes back.
5. The page then sends you on to the real site.

Each check takes seconds. Run them before you type anything.

Have a link you have not opened yet? See how to open a suspicious link safely.

1. Look at the full address, not the page design.
2. Read the hostname from right to left. In login.example.com.attacker.test, the owner is attacker.test.
3. Compare it with your bookmark for that service.
4. Notice whether your password manager offers a saved login. Silence on a familiar site is a warning.
5. Ask how you got there. Unexpected links deserve the most suspicion.
6. When unsure, close the tab and use your bookmark.

Yes, when you type the code by hand. NIST's SP 800-63B-4 excludes typed codes from phishing resistance. A relay kit forwards your code to the real site.

Microsoft described adversary-in-the-middle phishing in July 2022. The fake site proxied the real sign-in. It kept the password and the session cookie. Fraud followed in as little as five minutes.

Passkeys resist this relay. Google says passkeys are bound to a site's identity. Your browser will not offer one to a lookalike domain.

CISA rates FIDO and WebAuthn sign-ins as phishing resistant. It rates app codes as vulnerable to phishing. Its example: a fake portal that also takes your code.

Stolen cookies are covered under session hijacking and cookie theft.

Phishing is the delivery. The fake login page is usually the destination. APWG's Q2 2026 report counted 1,069,681 phishing attacks. That was up 10.1% from Q1. SaaS and webmail drew the largest share, 29.1%. APWG counts phishing sites reported by members and the public.

1. Open the real service from a bookmark.
2. Change the password there, then anywhere you reused it.
3. Sign out of all other sessions.
4. Check your MFA methods, recovery email, and phone number.
5. Remove connected apps you do not recognize.
6. Report the page to Google Safe Browsing.
7. Forward phishing email to reportphishing@apwg.org, as the FTC advises.
8. Shared card or ID details? Follow the steps at IdentityTheft.gov.

• New or hacked sites may not be blocklisted yet.
• HTTPS encrypts the connection. It does not confirm the owner.
• A relay kit can reuse a hand-typed code.
• Small mobile address bars hide most of the hostname.