Most phishing pages don’t hack anything. They simply look like a website you trust and wait for you to type your password. The trick is almost always in the name of the website, and fake names use only four tricks.
Trick 1: letters that look the same
arnazon.com (r + n looks like m), g00gle.com (zeros instead of o’s), or letters from another alphabet, such as a Cyrillic “а” that looks exactly like a Latin “a”. The Unicode standard even keeps an official list of such “confusable” characters (UTS #39).
Trick 2: one letter changed
amazom.com, paypa1.com, whatsap.com: one letter swapped, added or missing. This is called typosquatting. It works because we read words by their shape.
Trick 3: the brand plus an urgent word
paypal-secure-login.com, amazon-refund-help.net. The real company name is there, but the website belongs to someone else. Words like secure, verify, login, refund and support are favourites.
Trick 4: the brand in front of another website
paypal.com.verify-account.xyz looks like PayPal, but the real website is verify-account.xyz. Read a web address from the right: the part just before the first single “/” (here verify-account.xyz) is the owner.
Five habits that stop most phishing
- Read the address from the right, as in trick 4.
- The padlock is not a safety sign. It only means the connection is encrypted. Fake sites have padlocks too.
- Don’t log in from links in messages. Open the app, or type the address yourself.
- Use a password manager. It fills in your password only on the real website, so it refuses fakes.
- Be suspicious of urgency: “your account will be closed today” is the oldest trick there is.
More advice from the U.S. Federal Trade Commission: How to recognize and avoid phishing scams.
Let your phone check for you
The TacUNS Fake-website shield checks every website name an app looks up against these four tricks, before the page loads. In the Normal level it warns you (up to 5 alerts a day); in Strict and Kids it blocks. If a real site looks like a brand by accident, one tap on Trust stops the warning for it.
See how TacUNS works, or try our free DNS lookup tool to see who really runs a website name.