Why the address matters
A web page can imitate a bank, a shop or an email login screen almost perfectly. Logos, colors and wording are easy to copy. What is hard to copy is the address, because only one owner can control a given domain name. That makes the address the most reliable clue you can check, and the habit takes only a few seconds.
Lookalike sites are used to collect passwords, card details and personal information. Many people reach them through phishing messages, text messages or search ads, so reading the address is a skill worth building.
The parts of a web address
Take a made-up example: https://login.example-bank.com/account/settings?id=12.
https://is the scheme. It shows the connection is encrypted, which is not the same as trustworthy.loginis a subdomain, a label the owner of the domain can choose freely.example-bank.comis the domain, the part that identifies who controls the site. It consists of a name and an ending (.comhere)./account/settingsis the path, which points to a page within the site.?id=12is extra information passed to the page.
The part that matters most is the domain: read from the first single slash backward, and the last two labels before it usually identify the owner. Everything to the left of the domain is chosen by whoever owns it, and everything to the right of the slash is just a page on that site.
Some endings are made of two parts, such as .co.uk, in which case the owner’s name is the label before them. If you are unsure, that is itself a reason to type the official address manually.
Common tricks
Subdomain disguise. An address such as yourbank.com.secure-login.example begins with a familiar name but belongs to secure-login.example. Attackers rely on people reading from the left.
Extra words. Additions like -secure, -support, -login or -verify attached to a real brand name are often used by imitators. A real company may use such words too, but a surprise link containing them calls for care.
Swapped or similar characters. Replacing the letter “l” with a capital “I”, “o” with zero, or “rn” for “m” can fool a quick glance. Some tricks use characters from other alphabets that look the same as Latin letters.
Different endings. The right name with an unexpected ending, such as .net instead of .com, may belong to someone else entirely.
Hidden link text. A link in a message can show one address and lead to another. The displayed words do not have to match the destination.
Shortened links. Link-shortening services hide the destination until you click. Treat unexpected shortened links with suspicion.
Typos of real names. People mistype addresses, and some imitators register those typos to catch them.
How to inspect a link before you click
- On a computer, hover over the link without clicking. The destination usually appears at the bottom of the window.
- On a phone, press and hold the link, where this is supported, to preview the address. Be careful not to release onto the open option by accident.
- Read the domain from right to left, as described above, and ask whether it matches the organization you expect.
- For QR codes, take the same care. See our note on QR code safety for why the printed square tells you nothing about where it leads.
- If you are not sure, do not use the link. Open a fresh browser window and type the address you know, or use a saved bookmark.
This approach also works for emails, where email safety habits include checking the sender’s address as well as the link.
Check the address after the page loads
Redirects can send you somewhere different from where the link appeared to point. After a page opens, look at the address bar again before typing anything. If the address is not what you expected, close the tab.
Remember the padlock: it shows that your connection to the site is encrypted, but a lookalike site can have one too. The padlock tells you about the connection, not about the owner’s honesty, and you can read more about what the browser padlock does and does not mean.
Help from your tools
Password managers can help. Because they fill in a saved login only on the matching site, a failure to offer your login on a page that looks familiar is a useful warning. Browsers also warn about reported dangerous pages, though new fake sites may not be on those lists yet. Bookmarks for your bank and key services are a simple and effective safeguard.
Search results and ads
Not all lookalikes arrive by message. Paid search ads can sit above genuine results and appear to be the real site. For services where you enter money or login details, use a bookmark or type the address instead of searching each time.
If you entered details on a fake site
Act quickly. Change the password on the real site, and anywhere else you used it, from a clean device. Turn on two-step sign-in. If you gave card details, contact your card provider. Watch for signs of account takeover and report the fake page to the real organization and to your local fraud reporting service.
The habit in one line
Find the domain, compare it with the organization you expect and, when in doubt, go to the site yourself. This guide provides general information, and address formats can look different on different devices and browsers.