How Fake Websites and Lookalike Web Addresses Fool Visitors

Why a fake site can look perfect

A web page is just code that a browser turns into a design. Anyone can save the visible parts of a real page, such as the layout, logo, colours and wording, and host a copy elsewhere. The copy looks right because it is built from the original material. What cannot be copied is the address the page lives at, because the real organisation controls its own name.

That is why a fake site has to rely on the visitor not looking closely at the address. Most successful fakes combine a convincing page with a believable web address and a reason to arrive there in a hurry, such as a link in a message.

The parts of a web address

To spot a lookalike you need to know which part of the address identifies who is in charge. Take an example address such as login.example-bank.com/account. Reading from right to left up to the first single slash:

• .com is the top-level domain.
• example-bank.com is the registered domain, the part someone bought and controls.
• login is a subdomain, a label the domain owner can add freely.
• Everything after the first single slash, such as /account, is a path inside that site.

The registered domain is the part that matters. The owner of that domain can create any subdomain and any path they like. So example-bank.com.secure-check.net does not belong to example-bank.com at all. Reading it right to left, the registered domain is secure-check.net, and the familiar name is just a subdomain used to mislead.

Common lookalike techniques

Lookalike domains are built with a handful of reliable tricks.

• Small misspellings. Swapping, dropping or doubling a letter, so that a name is almost right.
• Characters that look alike. A lowercase “l” and a capital “I”, or the digit “0” in place of the letter “o”, can be hard to tell apart in some fonts. Some address systems also allow letters from other alphabets that resemble Latin ones, though browsers apply protections against many such cases.
• Familiar words added on. Adding “secure”, “login”, “support” or “verify” to a brand name makes an address seem official when it is not.
• Hyphens and extra segments. Names like brand-account-help read as plausible but are unrelated to the brand.
• Different endings. The same name under a less common top-level domain can be a different owner entirely.
• Brand name in the subdomain or path. The recognisable word appears early in the address, while the real domain is further along.

On a phone, long addresses are often shortened or partly hidden, which helps attackers. In an email or text, the visible link text can also differ from where the link actually goes.

What the padlock does and does not mean

Browsers show a padlock or similar indicator when the connection to a site is encrypted. Many people read it as “this site is trustworthy”, but it does not say that. It means the connection between you and that site is protected from eavesdroppers. A fake site can have an encrypted connection too, and certificates for ordinary domains are widely and easily available. So the padlock tells you about the line, not the owner.

Likewise, a professional design, correct spelling and familiar logos prove little, since all of them can be copied.

How a fake site collects what it wants

A copied login page shows fields for your username and password and sends what you type to the operator. Some forward it to the real site so that you are logged in and notice nothing, while the attacker keeps a copy. More elaborate fakes also ask for the verification code you receive, passing it to the real site at once, which can defeat basic two-factor authentication delivered by text.

Fake shops work differently. They advertise products at attractive prices, take a payment and either send nothing or collect card details for later use. Warning signs include prices far below everywhere else, no clear contact details, odd payment methods and very recent or poorly documented businesses. Our broader online shopping safety checks go into this further.

Reading an address properly

A few habits make the difference.

1. Find the registered domain. Look at the part just before the first single slash and work from the right. Ignore anything that comes before it as decoration.
2. Read slowly, not by shape. Attackers rely on glancing recognition. Spell the name out in your head.
3. Type or use a bookmark. For banks, email and other important accounts, go via a saved bookmark or the official app rather than a link in a message.
4. Preview links before opening them. On a computer, hovering over a link often shows its destination. On a phone, a long press may do the same. Treat this as a hint rather than a verdict.
5. Be wary of search adverts. An advertised result at the top of a search is not automatically the official site. Check the address before signing in.
6. Let tools help. A password manager normally fills a saved login only on the address it was saved for. If it refuses to fill on a page that looks right, that mismatch is a clue worth taking seriously. Passkey login is tied to the real site’s address in the same way, which makes it harder to hand to a fake.

If you entered details on a fake site

Act quickly but calmly. Change the password for that account, and for any other account that used the same one, from a trusted device. Contact your bank if you typed payment details, and consider fraud alerts if identity details were involved. Check for any further steps the account takeover recovery process suggests, such as signing out other devices. Reporting the fake address to the organisation being imitated and to your browser’s reporting feature can help get it blocked, although how quickly that happens varies.