A page that looks like your bank's, your email's or a shared document's sign-in, on another website. How to tell, and how to sign in without the risk.
From to me
Microsoft 365: Your mailbox is almost full. Sign in to keep receiving email: https://m1crosoft-
On this page
From to me
Microsoft 365: Your mailbox is almost full. Sign in to keep receiving email: https://m1crosoft-
From to me
Sarah shared “Q3 invoice.pdf” with you. Open: https://docs-
(then a page that asks for your email password)
Meta: Your page broke our rules and will be removed in 24 hours. Appeal here: https://meta-
Examples. The names and amounts change; the shape doesn't.
A sign-in from a link in a message. That's the whole trick: the page can look exactly like the real one.
The address isn't the company's. A letter swapped for a number (m1crosoft), extra words, a strange ending. On a phone, tap the address bar to see all of it. The padlock only means the connection is private, not that the site is real.
A shared file you weren't expecting that wants your password to open, or a form or survey on a well-known site that asks for one.
It asks for more than a sign-in usually does: your card, your full date of birth, the code you're sent.
Your password manager doesn't fill it in. It knows the real website, and this isn't it.
Sign in from the app, not from a link. Fake sign-in pages can look just like real ones. Open the app, use a bookmark, or type the website's address yourself. Not from a search ad: the top result can be a fake.
Never type a password or card number into a form from a message.
Still not sure? Check the message. We open its link on a phone and a computer, not yours, and tell you what it is.
Then delete it. You can report it to your police or your country's fraud reporting service. Your phone may also let you report it as junk or spam. In the US and UK, you can also forward a scam text to 7726.
In the US: ReportFraud.ftc.gov (the FTC's website, opens in a new tab)