Fake websites and lookalike addresses

A fake copy of a site can use the real logo and wording. It can’t use the real address.

If it’s happening now

A text, email, ad, QR code, or search result brought you to a page that wants you to sign in or pay. Close it. Open the company’s app or your bookmark, or type the address from your card, statement, or bill. If something really needs fixing, you’ll see it there.

Your password manager isn’t offering to fill in your password. It fills in only on the address it saved, so read the address. Don’t copy the password over by hand. Leave, and go there from your bookmark or the app.

Your browser shows a full-page warning. In Chrome it says “Dangerous site,” “Did you mean” another site, “Is this the right site?” or “Fake site ahead.” Safari and Edge have their own. Close the tab. Don’t open Details to visit anyway.

The page says to call a number, install something, or paste something to prove you’re human. Close it. Won’t close: A pop-up or call says your computer has a problem.

You called a number from a search result and they want to get on your computer, or want gift cards or a transfer. Hang up.

A caller sent you there. Hang up. Someone is on the line or on my screen right now.

What to say

• I typed my card number into a fake copy of a website. Can you close this card, send me a new one, and tell me if anything's pending? I'd like a case number.

• I also typed in the code you texted me. Can you take my card off any phone or watch I didn't add?

• I signed in on a fake copy of your website, so they may have my password. Can you lock my online banking, check for transfers and anyone newly added to send money to, and give me a case number?

• I paid a website that turned out to be fake, and nothing's coming. I want to dispute the charge. Where do I send that in writing?

If something already left your hands

Typed it but didn’t press the button? Treat it as sent. Some fake pages grab it as you type.

If a card, your bank, or a payment is involved, call your bank or the payment company first (the number on your card or in the app). Then change passwords. Then report it.

A card number

Ask for a new card and whether anything is pending. Typed in a texted code too? Say so: on fake toll and delivery pages, it can add your card to the scammer’s phone wallet. Ask them to remove your card from any phone or watch you didn’t add.

Credit card: dispute charges you didn’t make in writing, within 60 days of the statement that shows them. Debit card: report it today; what you can owe grows the longer you wait. I paid with a credit or debit card.

A password

Change the one you typed in, from a device you trust, in the app or on an address you type. Same password as your email? Change email first: whoever has your email can reset everything else. Used it anywhere else? Change it there too.

In each account, sign out of other devices and check that the phone number and email for resets are still yours. Then turn on a passkey or an authenticator app. Text-message codes are better than nothing. Locked out: Someone got into my account.

Your Social Security number or a photo of your ID

Freeze your credit with Equifax, Experian, and TransUnion. It’s free. Steps: I gave out a code, password, or card number.

Money for something that isn’t coming

Credit card: dispute it in writing within 60 days of the statement that shows it. Debit card: call the bank today and ask them to dispute it. You may not get a refund for something that never came, but ask.

Zelle, wire, or payment app: call the bank or app now and ask them to stop or reverse it. Gift card: call the number on the back of the card and ask them to freeze it. Crypto: call the ATM company or the exchange. For a wire or crypto, also file at ic3.gov at the same time.

Money you sent yourself may be treated as authorized and often isn’t reimbursed. If they say no, ask for the decision in writing, then file at consumerfinance.gov/complaint. Next steps: I paid or sent money. Anyone offering to get it back for a fee is a second scam: Someone offers to get my money back.

Something you downloaded or pasted

Not opened: delete it. Opened, installed, or pasted something the page told you to: hold the power button until the computer shuts off. From another device, call your bank if you bank on that computer, then change your email and bank passwords. Treat any password saved in that computer’s browser as seen. Don’t bank on it again until it’s been cleaned: I let someone control my computer.

Then report it

If the page is still open, screenshot it with the address showing. Report the address to Google Safe Browsing; Chrome and Safari both check its list. Lost money or information: ReportFraud.ftc.gov. If money left, ic3.gov too.

How to read an address

1. On a phone, tap the address bar to see the whole address.
2. Find the first single slash (/). Skip the two in https:// if they’re showing. No slash? Start at the end.
3. Read left from there and stop at the second dot. What you’ve read says whose site it is. Anything further left is a label the owner chose. An ending with two parts, like .co.uk, counts as one.

Say your bank is fernmontbank.com:

• secure.fernmontbank.com/signin is the bank’s.
• fernmontbank.com-signin.help/login belongs to com-signin.help. The bank’s name is just the front of it.
• fernmontbank.secure-signin.net belongs to secure-signin.net.
• fernrnontbank.com isn’t the bank. An r and an n stand in for the m.

.gov is the exception. Only US government organizations can get an address ending in .gov. irs.gov-refund.help ends in .help, so it isn’t the IRS. Other endings prove nothing: anyone can buy a .com or .org, and some real toll agencies use .com.

You can’t know every real address. Companies use several. An unfamiliar one on a page you reached yourself can be fine. A familiar name a letter off isn’t.

What it looks like

You typed your bank's address yourself. The page looks the way it always does. Your password manager hasn't filled anything in.

fernmontbnak.com/signin

Fernmont Bank

Good morning

Sign in to Online Banking

Username

Password

Remember my username

[ Sign in ]

Forgot username or password?

What do you do?

• Type the password in. You typed the address yourself
• Open your password manager, copy the Fernmont password, and paste it in
• Close the tab and open the bank from a bookmark or the bank's app

Show the answers

• Wrong move Type the password in. You typed the address yourself Read the address: fernmontbnak.com. The n and the a are swapped. Typing the address only protects you when you type it right.
• Wrong move Open your password manager, copy the Fernmont password, and paste it in It didn't fill because this isn't the address it saved the password for. Copying it over hands the password to whoever owns fernmontbnak.com.
• Best move Close the tab and open the bank from a bookmark or the bank's app The password manager's silence was the warning. A bookmark or the app can't be mistyped. Next time you're on the real site, bookmark it.

When your password manager stays quiet, read the address. A letter off: leave, and use a bookmark or the app.

You're on a computer without the Fernmont app and want to check your balance. You search for the bank.

fernmont bank login

Sponsored
Fernmont Bank
fernmontbank.com
Fernmont Bank Online Banking | Sign In to Your Account
Securely view balances, pay bills, and transfer money. Sign in now.

Fernmont Bank
fernmontbank.com
Fernmont Bank | Checking, Savings, Credit Cards & Loans
Sign in to Online Banking. Open an account, find a branch, or contact us.

Both show the bank's address. What do you do?

• Type fernmontbank.com into the address bar yourself
• Tap the first result
• Scroll past the ad and tap the regular result

Show the answers

• Best move Type fernmontbank.com into the address bar yourself Typing the address skips the ads entirely. Not sure of it? It's on your statement.
• Wrong move Tap the first result It's an ad. Fake ones sit in the same spot, look the same, and lead to a copy of the real site.
• Okay Scroll past the ad and tap the regular result Better than the ad. Before you type a password, read the address on the page you land on.

Type the address. If you search anyway, skip the ads and read the address before you sign in.

You opened Fernmont from your own bookmark and clicked Sign in. The address changed to this.

secure.fernmontbank.com/signin

Fernmont Bank

Sign in to Online Banking

Username

Password

[ Sign in ]

Whose page is this?

• Someone else's. The bank's address is fernmontbank.com, not secure.fernmontbank.com
• Fernmont Bank's
• Can't tell. Call the bank before signing in

Show the answers

• Wrong move Someone else's. The bank's address is fernmontbank.com, not secure.fernmontbank.com Only whoever owns fernmontbank.com can put words in front of it. Plenty of real banks sign you in on an address that starts with something like secure.
• Best move Fernmont Bank's Find the first single slash and read left to the second dot: fernmontbank.com. That's the bank's address. Anything further left, like secure, is a label the bank chose.
• Okay Can't tell. Call the bank before signing in Safe, but slower. The address already answers it.

Read left from the first single slash and stop at the second dot. secure.fernmontbank.com is the bank's: fernmontbank.com. fernmontbank.com-signin.help isn't: it's com-signin.help.

What they’ll ask for

Whatever it asks, close it and go there yourself.

“Sign in to continue.” “Verify your account.” If your account needs anything, the app will say so.

“Pay $1.99 to reschedule your delivery.” “Pay your toll balance.” Toll: open your toll account from the address on your bill or the agency’s app. Package: track it with the number from your order, on the carrier’s own site or app. A text says you owe a toll or parking fine. A text about a package, account, or payment.

“Enter the code we just sent to your phone.” On a page you didn’t reach yourself, the code goes to whoever runs it.

“To verify you’re human, press Windows+R, then Ctrl+V, then Enter.” Real “I’m not a robot” checks never ask you to paste anything. What you paste runs on your computer. On a fake Social Security site, it installed a remote-control program. Already did it: see “Something you downloaded or pasted” above.

Getting there yourself

Use the app or a bookmark for your bank, cards, email, and stores. Don’t search for them: the first results may be paid ads, and scammers buy them too. Type the address instead. For a company you’ve never used, scroll past anything marked Sponsored and read the address on the page you land on.

Get phone numbers the same way. Not from a search result. Use the number on your card, statement, or bill, or in the app.

Let your phone or browser save your passwords (the Passwords app on iPhone, Google Password Manager on Android and Chrome), and add a passkey where a site offers one. Neither will fill in on a fake copy. Rehearse the moment it stays quiet in the Practice Lab (“Let the manager remember a login”).

Leave the warnings on. Chrome on a computer: More (three dots) > Settings > Privacy and security > Security, then Standard or Enhanced protection. Android: Chrome > More (three dots) > Settings > Privacy and security > Safe Browsing. iPhone: Settings > Apps > Safari > Fraudulent Website Warning. Mac: Safari > Settings > Security > “Warn when visiting a fraudulent website.” No warning doesn’t make a site safe.

What not to waste time on

The padlock. The padlock means encrypted, not honest. Nearly all fake sign-in pages have one. Chrome on a computer replaced its padlock with a settings icon in 2023. “Not secure” next to the address still means type nothing.

How the page looks. A perfect copy proves nothing. A sloppy one is a reason to leave.