Talk to us
English is the default.
A worked example

A familiar-looking page can be the wrong page

One exchange at a time. Read what changes, then explain it in your own words before moving on.

Read the full lesson
  1. Meet the components
  2. Follow the steps
  3. Compare an example
  4. Check your understanding

Interactive example

Steps1. Sign in now 2. Password entered 3. Secret copied
Click a box or choose its name to learn what it means.
YouReadyFake pageReadyScammerReadyReal serviceReadyYouReadyFake pageReadyScammerReadyReal serviceReady
Ready to tracePassword entered
Before you start · 3 steps

Password entered

The design of a page does not prove who will receive the information.

How to use this example

Select Next step to read at your own pace, or Animate step to watch one exchange. Nothing advances until you choose.

Inspect components & read every step
  • You

    The person making the decision in this fictional example.

    Example: You decide whether to share information, approve a request or check it first.

  • Fake page

    A page impersonating a legitimate service.

    Example: A copied sign-in page can send your entered password to a scammer.

  • Scammer

    A person using deception to obtain money, information or access.

    Example: They send a misleading link and copy a familiar brand.

  • Real service

    The legitimate service you intended to use.

    Example: You open its known app instead of following a suspicious message link.

Password entered

The design of a page does not prove who will receive the information.

  1. Fake page You: Sign in now. A lookalike page presents an urgent sign-in request.
  2. You Fake page: Password entered. The password is sent to the page you are using.
  3. Fake page Scammer: Secret copied. The scammer can receive the submitted information.

Real service opened

A known independent route avoids letting the message choose where you sign in.

  1. Fake page You: Urgent request. A page asks you to act immediately.
  2. You Real service: Known app. You open the service through your saved app or address.
  3. Real service You: Account status. Review whether the claimed problem exists in the real account.

Typed codes can be stolen too

Ordinary typed MFA codes can be relayed; MFA does not make a fake form safe.

  1. You Fake page: Typed code. A fake page also asks for a current sign-in code.
  2. Fake page Scammer: Code copied. The code can reach the scammer before it expires.
  3. Scammer Real service: Code used. The real service may accept a relayed code; site-bound passkeys work differently.

Fictional teaching trace. One moving dot represents an exchange, not a measured network capture.