How to Spot a Fake Login Page: A Phishing Awareness Guide

Every business, no matter how careful, will eventually get a phishing email that looks real. The dangerous ones don’t come with obvious red flags — bad spelling, a strange sender address, or a request that seems too good to be true. The dangerous ones look exactly like your Microsoft 365 login page, right down to the logo. This guide covers how to spot a fake login page before you type in a password, what to do if you’ve already clicked, and how organizations build a workforce that catches these attempts before they cause damage.

What Is a Fake Login Page?

A fake login page — sometimes called a phishing page or credential harvesting page — is a webpage designed to look like a legitimate sign-in screen for a service you already trust: Microsoft 365, your bank, your payroll provider, even your own company’s VPN portal. It usually arrives through a link in an email, a text message, or a chat message that creates urgency: an invoice that needs approval, a shared document, a security alert about your account. The link leads to a page that looks nearly identical to the real thing. When you type in your username and password, that information goes straight to the attacker instead of the service you meant to log into.

This remains one of the most common ways attackers get into a business, because it doesn’t require breaking any technology — it only requires one person, on one bad afternoon, to trust the wrong page.

7 Ways to Spot a Fake Login Page

1. Check the actual domain, not just the logo

Attackers can copy a logo perfectly. They can’t fake the domain name in your browser’s address bar. Click into the address bar and read the domain carefully, right to left: login.microsoftonline.com is legitimate; microsoftonline-login-secure.com or micros0ft-secure-login.net are not. Watch for extra words, swapped letters (a zero for an “o”), and unfamiliar endings like .net or .info standing in for a domain you’d expect to see as .com.

2. Don’t stop at the padlock icon

A padlock in the address bar means the connection is encrypted — it says nothing about whether the site is trustworthy. Phishing pages can and do have valid HTTPS certificates. Treat the padlock as neutral information, not a stamp of approval.

3. Hover before you click

On desktop, hovering your mouse over a link (without clicking) shows the real destination URL, usually in the bottom corner of your browser or email client. If the text says “Microsoft 365” but the link underneath points somewhere else entirely, that’s your answer.

4. Be suspicious of urgency

“Your account will be suspended in 24 hours.” “Invoice overdue — pay immediately.” “Unusual sign-in detected — verify now.” Urgency is a deliberate tactic: it pushes people to act before they think. Legitimate security alerts from Microsoft, Google, and your bank rarely demand action within a countdown timer.

5. Check the sender’s actual email address

Display names are easy to fake. Click or tap on the sender’s name to reveal the full email address behind it. An email claiming to be from “Microsoft Support” sent from a personal Gmail address or a domain unrelated to Microsoft is a clear warning sign.

6. Notice generic greetings and off-writing

“Dear Customer” instead of your name, awkward phrasing, or formatting that doesn’t quite match the company’s usual emails are all signals — though be aware that well-resourced attackers increasingly get this part right too, so don’t rely on writing quality alone.

7. Verify through a separate channel

If an email claims to be from your bank, IT department, or a vendor asking you to log in or approve something, don’t use the link in the email. Open a new browser tab and type the website address yourself, or call the person or company using a phone number you already know is real — not one provided in the message.

Legitimate vs. Fake Login Page: Quick Reference

What to Do If You Already Clicked

If you’ve entered credentials on a page you now suspect was fake, acting quickly limits the damage:

1. Change the password immediately — on the real site, typed directly, not through any link from the suspicious email.
2. Enable or check multi-factor authentication (MFA) on the affected account, and review any devices or sessions you don’t recognize.
3. Notify your IT department or provider right away. The faster a compromised account is identified, the smaller the window an attacker has to act.
4. Check for account activity you don’t recognize — forwarding rules set up in email, unfamiliar sign-ins, or unexpected changes to account recovery information.
5. Report the phishing email to your email provider and, if it impersonated a real company, to that company as well.

How West Tech Pilots Runs Security Awareness Training for Organizations

Technical defences — spam filtering, endpoint protection, 24/7 monitoring — catch a large share of phishing attempts before they ever reach an inbox. But no filter catches everything, which is why employee awareness is treated as a core part of a security program, not an afterthought. Employee security training is one of the services we build into our Cybersecurity Services for clients across the Lower Mainland.

In practice, that means combining ongoing education with the same monitoring infrastructure that protects the rest of a client’s environment: making sure staff know what a fake login page looks like, what to do when something feels off, and who to contact the moment they suspect a mistake — without fear of blame for reporting it. A team that reports a suspicious click within minutes gives an IT provider a real chance to contain it before it becomes a breach; a team that stays quiet out of embarrassment does not.

Frequently Asked Questions

Can a fake login page really look identical to the real one?

Yes. Attackers routinely copy the exact HTML, CSS, and logos of real login pages. The visual design gives almost no reliable signal — the domain name is what matters.

Does having a password manager help?

Yes, in a very specific way: a password manager only auto-fills credentials on the exact domain it has saved. If you land on a lookalike domain and your password manager doesn’t offer to fill in your login, that’s a strong warning sign worth stopping for.

Is multi-factor authentication (MFA) enough to stop phishing?

MFA stops many phishing attempts from resulting in a full account takeover, since a stolen password alone isn’t enough to log in. It isn’t a complete solution on its own — some phishing techniques are built specifically to intercept MFA codes too — but it remains one of the highest-value protections available. It should be enabled everywhere it’s offered.

What should employees do if they’re not sure whether a page is real?

Stop before entering anything, and ask. A quick message to IT that turns out to be a false alarm costs nothing. A password typed into a fake page can cost a great deal more.