Innomerc One useful thing to do today
Use known navigation and verify the destination before entering a secret.
More everyday safety lessonsChoose your depth. Learn at your own pace.
Understand it
A fake login page imitates a familiar service while sending information to a different operator. Logos, colors and even HTTPS can be copied or obtained. The important question is where the browser is actually connected.
Compare the fictional addresses accounts.cedar.example and cedar.example.signin.example.net. In the second, familiar words appear inside a different domain. These reserved example names are illustrations, not services to visit. Use a bookmark or known app when unsure.
Under the hood
The host is only one part of a URL. Text in a path or query does not change which host receives the request. Subdomain labels can make a long address confusing, and internationalized names require careful browser display handling.
Password-manager matching and WebAuthn origin binding help at different points. A manager may refuse to autofill an unrelated site; WebAuthn authenticates for a relying party rather than releasing a reusable secret to any page. Neither guarantees that the device itself is uncompromised.
Practitioner perspective
Analyze the submitted form destination, redirects and the relationship between visible branding and origin in an isolated authorized environment. A page may forward to a real site after collecting data, so a legitimate final page does not clear the earlier interaction.
For a suspected account compromise, preserve the reported address and time, review sign-in and session events, and remove unauthorized factors or recovery changes. Do not ask a user to reproduce the incident by re-entering real credentials.
Watch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
A familiar-looking page can be the wrong page
Compare entering a secret with returning to the real service. This models information flow, not a real attack.
The design of a page does not prove who will receive the information.
How to use this example
Select Next step to read at your own pace, or Animate step to watch one exchange. Nothing advances until you choose.
What it means
Everyday example
State in this scenario
Inspect components & read every step
- You
The person making the decision in this fictional example.
Example: You decide whether to share information, approve a request or check it first.
- Fake page
A page impersonating a legitimate service.
Example: A copied sign-in page can send your entered password to a scammer.
- Scammer
A person using deception to obtain money, information or access.
Example: They send a misleading link and copy a familiar brand.
- Real service
The legitimate service you intended to use.
Example: You open its known app instead of following a suspicious message link.
Password entered
The design of a page does not prove who will receive the information.
- Fake page You: Sign in now. A lookalike page presents an urgent sign-in request.
- You Fake page: Password entered. The password is sent to the page you are using.
- Fake page Scammer: Secret copied. The scammer can receive the submitted information.
Real service opened
A known independent route avoids letting the message choose where you sign in.
- Fake page You: Urgent request. A page asks you to act immediately.
- You Real service: Known app. You open the service through your saved app or address.
- Real service You: Account status. Review whether the claimed problem exists in the real account.
Typed codes can be stolen too
Ordinary typed MFA codes can be relayed; MFA does not make a fake form safe.
- You Fake page: Typed code. A fake page also asks for a current sign-in code.
- Fake page Scammer: Code copied. The code can reach the scammer before it expires.
- Scammer Real service: Code used. The real service may accept a relayed code; site-bound passkeys work differently.
Fictional teaching trace. One moving dot represents an exchange, not a measured network capture.
Open the detailed lesson walkthrough
Explore the system
Familiar logo
A copied logo creates recognition.
Read every step without animation
Trust the appearance
- Familiar logo. A copied logo creates recognition.
- Wrong origin. The browser is connected to a different operator.
- Information exposed. A secret entered here would go to that operator.
Visual similarity does not establish identity.
Check the destination
- Known bookmark. Navigate to the service through a saved trusted route.
- Expected origin. Check that the browser is at the intended domain.
- Normal authentication. Use the service’s established sign-in method.
Verify the receiving service before sharing information.
What could go wrong
The diagram compares recognizing a brand with verifying the receiving origin. No credentials are collected and no external login page is loaded.
What you can do
- Use known navigation and verify the destination before entering a secret.
- Prefer phishing-resistant authentication where supported.
- Report the page through the organization’s established reporting process.
Common mistakes
- A padlock is not a brand-ownership certificate.
- Familiar text anywhere in a URL does not make the host legitimate.
Check your understanding
Active recall: explain this idea in 30 seconds
A fake login page imitates a familiar service while sending information to a different operator. Logos, colors and even HTTPS can be copied or obtained. The important question is where the browser is actually connected.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
Content reviewed 2026-09-10. Read the editorial policy.