How to Detect a Fake Website or Login Page (and Report It)
Last reviewed: October 2026
The short answer: To spot a fake website, read the web address carefully, because the real owner is the domain just before the ending (such as .com or .net). Be wary of misspellings, extra words, odd subdomains and pages you reached through a link in a message. If it asks for a login, don't type anything. Go to the real site yourself, or paste the link into PhishGlass to check it without visiting. To report a fake page, send it to Google Safe Browsing, the company being impersonated, and your national authority.
A fake login page is the final step of most phishing attacks. The email, text or QR code is just the delivery method. The fake page is where your password, card number or one-time code actually gets stolen. It can look exactly like the real thing, down to the logo, colors and error messages, so the page itself is rarely a reliable clue. The web address is.
This guide shows you how to read an address properly, what tricks scammers use, how to check a suspicious site safely, and how to report it.
How to read a web address (the 10-second skill)
Every web address has parts, and scammers rely on you not looking closely. Take this example:
https://login.yourbank.com.secure-check.net/signin- https:// is the protocol. It tells you the connection is encrypted, not that the site is honest.
- login.yourbank.com.secure-check.net is the hostname. This is the part that matters.
- /signin is the path. Anything here can be anything the owner likes.
To find the real owner, read the hostname from right to left until you hit the first single dot before the ending. Here the owner is secure-check.net, not yourbank.com. Everything to the left is just a label the owner can freely choose.
The real address would be login.yourbank.com, where the owner is yourbank.com.
The 8 tricks scammers use to fake a website address
| Trick | Example (defanged) | How to spot it |
|---|---|---|
Subdomain disguise | paypal.com.account-verify[.]net | The real owner is account-verify.net |
Typosquatting | paypa1[.]com, gooogle[.]com | A swapped, doubled or missing letter |
Lookalike characters | arnazon[.]com | "rn" imitating "m", "I" (capital i) imitating "l" |
Extra words | yourbank-secure-login[.]com | Real banks rarely use hyphenated login domains |
Wrong ending | yourbank[.]co or yourbank[.]xyz | Different ending from the official site |
Lookalike letters from other alphabets | A domain that uses a Cyrillic "a" in place of a Latin "a" | Looks identical, but the browser may show it in a special encoded form |
Long, messy addresses | yourbank[.]com@evil-site[.]net/x | Everything before the "@" is ignored. The real destination comes after |
Shortened or redirecting links | bit[.]ly/3xYz... | Hides the real destination until you click |
Why the padlock isn't proof
For years, people were told to look for the padlock. It's now much less useful. The padlock only means the connection between you and the site is encrypted. Scammers can get that for their fake sites too, so a padlock on a phishing page is common. Check the domain, not the padlock.
7 signs a login page is fake
You got there from a message
If you reached the page through an unexpected email, text or QR code, treat it as suspect.
The domain is wrong
Always check the address bar first.
Your password manager won't fill in your details
Good password managers match the exact domain. If yours stays blank on a page that "looks right," that's a strong signal.
It asks for too much
A sign-in page that also wants your card number, PIN or full ID is wrong.
It asks for your one-time code straight away
Fake pages often relay your details to the real site in real time and ask for your code to complete the login.
The page is oddly empty
Few links, no footer, and menu items that don't work.
Your browser warns you
Take browser warnings seriously. Don't click through.
How to check a suspicious link safely
Don't open it to find out
Even visiting a bad page carries some risk, and it's where the real danger starts.
Preview the full address
Hover over the link on a computer, or press and hold on a phone.
Find the real owner
using the right-to-left rule above.
Go to the real site yourself
Type the address directly or use your saved bookmark or official app, then check whether the same notice or request exists there.
Run it through a checker
Paste the link into PhishGlass, which looks for spoofed domains and other signs of phishing and gives you a risk score.
Check the domain's age if you're curious
Many scam domains are only days or weeks old. You can look this up with a WHOIS lookup tool.
The easy way: check a link with PhishGlass
If you don't want to dissect addresses by hand, PhishGlass does it for you. It's an AI-powered tool from ReverseAI that analyzes suspicious links, emails, texts and QR codes, including spoofed domains, and gives you a plain-language risk score with tips for next steps.
To check a link:
- Copy the link without opening it.
- Paste it into PhishGlass.
- Read the risk score and what looked suspicious.
- Follow the tips, and report the page if it's a scam.
PhishGlass is a helpful check, not a guarantee. If it involves money or an account, always confirm with the real company through its official site or app.
How to report a fake login page
Reporting takes a couple of minutes, and it helps get pages blocked and taken down, which protects other people. You don't have to do all of these. Start with the first two.
| Who to report to | What it does | How |
|---|---|---|
Google Safe Browsing | Helps get the page flagged with warnings in Chrome and other browsers | Use Google's "Report Phishing Page" form |
The company being impersonated | Lets them take legal and technical action | Forward the message or send the URL to the official abuse, fraud or security address on their website |
Your browser or security software | Adds the page to its block list | Use the "Report unsafe site" option in your browser's menu |
The hosting provider or domain registrar | Can take the site down | Look up who hosts the domain and send an abuse report |
Anti-Phishing Working Group (APWG) | Shares data with security researchers and industry | Forward phishing emails to reportphishing@apwg.org |
US national authority | Official record and trend tracking | reportfraud.ftc.gov |
UK national authority | Official record and takedown requests | Forward emails to report@phishing.gov.uk, texts to 7726 |
Australia national authority | Official record and consumer protection | Report at scamwatch.gov.au |
Singapore national authority | Official record and alerts | Report through ScamShield (scamshield.org.sg) or call 1799 |
India national authority | Official record and cybercrime tracking | Report at cybercrime.gov.in |
Japan national authority | Official record and awareness | Report to the Japan Cybercrime Control Center (JC3) |
Tip: when you report, include the full web address (defanged if you're posting it publicly), where you found it (email, text, QR code), and a screenshot. Never visit the page again just to collect evidence.
What to do if you already entered your password
Act quickly. The sooner you change things, the less damage can be done.
- Change the password for that account immediately, from a trusted device and by going to the real site yourself.
- Change it anywhere else you used the same password. This is why reusing passwords is risky.
- Turn on two-factor authentication for the account, ideally using an authenticator app or security key.
- Check recent activity. Look at sign-in history, forwarding rules in your email and recent transactions.
- If you shared card or bank details, call your bank straight away using the number on your card.
- If you gave away a one-time code, treat the account as compromised and secure it right away.
- Watch for follow-up scams. Once scammers have your details, they may contact you again pretending to be "support."
- Report the page, using the table above.
For more, see our complete guide to what to do if you clicked.
Frequently asked questions
How can I tell if a website is fake?
Read the web address carefully, because the real owner is the domain just before the ending. Look for misspellings, extra words, odd subdomains and unfamiliar endings. Be extra cautious if you reached the page through a message, and go to the official site yourself instead.
How do I check if a URL is safe?
Don't open it. Preview the full address, work out who owns the domain, compare it with the official site, and paste it into a link checker such as PhishGlass.
Does the padlock mean a website is safe?
No. The padlock only means the connection is encrypted. Scammers can get one for fake sites too, so always check the domain rather than relying on the padlock.
How do I report a fake login page?
Report it to Google Safe Browsing, to the company being impersonated, and to your national authority. You can also report it to the hosting provider or domain registrar, and to the APWG. Include the full address, where you found it and a screenshot.
What happens if I enter my password on a fake site?
The scammers can use it to access your account and any others that share the password. Change it immediately from a trusted device, turn on two-factor authentication, check recent activity and contact your bank if you shared financial details.
Can a fake website infect my device?
Some can, usually by tricking you into downloading a file or running a command, but most fake login pages are designed to steal your details rather than install anything. Don't download files or follow on-screen instructions from a page you don't trust.
Why does my password manager not fill in my details on a site that looks right?
Good password managers match the exact domain. If yours doesn't offer your saved login, you may be on a lookalike site. Stop and check the address.
Is there a free tool to check a suspicious website?
Yes, there are several, including PhishGlass. You can also check the domain yourself using the steps above.
Check the address. Not the design.
Fake pages can copy everything except the address. Spend ten seconds on it, or let PhishGlass do it for you.
Check a link with PhishGlass