Learn 10 practical warning signs of a phishing website, from lookalike domains to fake login forms, so customers and staff stop before typing a password.
Phishing websites are built to look exactly like a page you trust: your bank, your webmail, a delivery company or your employer’s single sign-on portal. The good news is that almost every fake site leaves clues. Below are ten warning signs that customers and employees can learn to check in a few seconds, plus what to do when something feels wrong.
Start with the address bar
The single most reliable signal is the domain name. A design can be copied pixel for pixel, but the attacker cannot use your real domain.
1. The domain is almost, but not quite, right
Look for swapped or added characters: examp1e.com instead of example.com, exarnple.com where “rn” imitates an “m”, or extra words such as example-secure-login.com. We explain these tricks in detail in our guide to typosquatting and homoglyph domains.
2. The real brand appears in the wrong place
Attackers often put the brand name in a subdomain or in the path: example.com.account-check.net or login-check.net/example/. Read the address from right to left. The part immediately before the top-level domain (.com, .net, .com.tr) is what actually owns the page.
3. The padlock is treated as proof
A padlock or “https” only means the connection is encrypted. Free certificates are easy to obtain, so many phishing sites have one. It tells you nothing about who runs the site or whether it is honest.
Read the message that brought you there
4. Urgency, fear or an unexpected reward
“Your account will be suspended today.” “Your parcel is on hold.” “You have won a gift card.” Pressure to act immediately is a deliberate technique designed to stop you from checking the details.
5. A link you did not ask for
If you reached a login page from an SMS, an e-mail, a social media message, an ad or a QR code, be extra careful. Legitimate services rarely need you to sign in through a link they just sent you. When in doubt, open the official app or type the address yourself.
Look at what the page asks for
6. More data than the task requires
A delivery update does not need your full card number, and a password reset does not need your national ID number and your mother’s maiden name. Long, intrusive forms are a classic sign of data harvesting.
7. Requests for one-time codes
Codes sent by SMS or generated by an authenticator app exist to prove that you are the person signing in. A page, chat agent or caller asking you to pass that code on is trying to take over your account or approve a payment in your name.
8. Unusual payment methods
A request to pay a small “fee” by card on an unfamiliar page, or to pay with gift cards, cryptocurrency or a transfer to a personal account, is a strong indicator of fraud.
Notice the small inconsistencies
9. Broken details around a perfect logo
Phishing kits usually copy the main screen well and neglect everything else: footer links that go nowhere, a language switcher that does not work, an outdated design or a copyright year that does not match. AI tools have made spelling mistakes less common, so do not rely on grammar alone.
10. Your password manager stays quiet
Password managers fill in credentials only on the domain where they were saved. If yours does not offer to autofill on a page that claims to be a site you use every day, stop and check the address. This is one of the most underrated anti-phishing defenses available.
What to do if you spot one
- Do not enter anything. Close the tab. If you already typed a password, change it immediately on the real site and turn on two-factor authentication.
- If you shared card details or a one-time code, call your bank using the number printed on your card and ask them to block it.
- Report it. Forward the message to the impersonated company’s official security or abuse address and use your browser’s “report unsafe site” option. In Türkiye you can also report malicious links to USOM, the national CERT.
- At work, use the phishing report button or tell your security team, even if you are not sure. An early report protects colleagues who received the same message.
For brands: make the checks easier
Brand owners can reduce the damage long before a customer needs these tips. Publish your official domains and support channels clearly, tell customers what you will never ask for, and give them a simple way to report suspicious pages. Most importantly, monitor for lookalike domains and cloned pages so they are found and taken down by you, not discovered by victims.
Phishvoid watches for sites impersonating your brand and handles takedowns through hosts, registrars, CDNs and browser blocklists under one subscription. Book a free exposure scan to see what is already out there, or report a phishing site you have come across.
Is someone impersonating your brand?
We find lookalike domains and cloned pages and take them down. Start with a free exposure scan.