How to spot a fake login page.

Check before entering a password

• Confirm the exact domain in the address bar, not the page heading.
• Be suspicious when a login page opens from an unexpected email, ad or document.
• Notice whether your password manager recognizes the site. A mismatch is a useful warning.
• Do not approve an MFA prompt you did not initiate.
• Close the page and open the service through a saved bookmark when unsure.

Why a perfect-looking page can still be fake

Images, colors and layouts can be copied in minutes. Some phishing kits proxy a real website so the page behaves normally while stealing credentials and session tokens. Visual quality is not proof of authenticity.

If you already entered credentials

Change the password from the official site, revoke active sessions, enable multi-factor authentication and report the page. If the password was reused, change it everywhere it was used.