Before signing in, check the domain rather than the logo

Guidance reviewed on 11 November 2026.

A company logo, color scheme and login page can be copied. Verification should therefore begin with the browser's destination, rather than the page's appearance alone. An attacker may use a changed character, an extra word or a lookalike domain, placing the familiar brand elsewhere in the address to create confusion.

If an unexpected message asks you to sign in, open your usual application or type the known address yourself instead of following its link. Read the complete domain and be cautious with shortened addresses that conceal the final destination. A previously verified bookmark can help with frequently visited services, although genuine address changes still require checking.

An HTTPS connection does not establish that the intended company owns the website. Encryption protects communication with the destination you opened; it does not make a fraudulent destination legitimate. Likewise, appearing in an advertisement or prominent search result does not establish the financial or regulatory credibility you might require.

When uncertain, do not enter credentials or upload documents. Contact the organization independently and compare the address with its official information. If a password was entered on a suspicious page, change it through the genuine service and review active sessions and recovery methods. Check other accounts where the same password was reused. A brief destination check can prevent a much longer effort to resolve unauthorized access.