When the phishing page looks exactly like your login
Modern phishing pages are perfect copies. Your password manager is the best detector you have.
Telling people to “look for spelling mistakes” doesn’t work anymore. Phishing pages today are pixel-perfect copies of your Microsoft or Google login, sometimes with your company logo, sent from a real hacked mailbox.
The best detector is boring: your password manager. It fills your password only on the real domain. If you land on a login page and it offers nothing, stop. Don’t copy the password in by hand. That pause catches more phishing than any training slide.
Some kits also sit in the middle and pass your login to the real site, grabbing your session even if you use MFA codes. Two things beat that:
- Passkeys or hardware keys, which refuse to work on the wrong domain.
- Conditional access that only accepts logins from managed devices, if your platform supports it.
And make reporting one click. “I typed my password into something weird” at 9:05 is a password reset. At 5 pm it’s an incident.