Guide · Logging in · 4 min read

Is it safe to log in to this website?

A fake login page is the most common way accounts get stolen. A few habits make it very hard to fool you.

Type the address or use a bookmark

Links in emails and messages are how phishing works. For your bank, email or work accounts, go to the site yourself from a bookmark or by typing the address.

Let a password manager do the checking

A password manager only fills a login on the exact site you saved it for. If it does not offer your password, that is a signal worth listening to.

Turn on two-factor sign-in, and prefer passkeys

Even if a password leaks, a second step stops most takeovers. Passkeys and hardware keys are the strongest because they are tied to the real site and cannot be typed into a fake one.

Be careful with “Sign in with Google/Apple”

These are convenient and often safer than a new password, but only on sites you already trust, and only after checking what access the site requests.

Know what a fake login looks like

Wrong address, urgent language (“your account will be closed”), a login page opened from a message, or a page that asks for your password plus card details or recovery codes at once.

If you typed your password on a fake site

  1. Change that password on the real site now, then anywhere you reused it.
  2. Turn on two-factor sign-in and sign out all other sessions.
  3. Check recent activity and forwarding rules in your email.
  4. If it was a bank login, call the bank.

Check what others said about logging in

The Logging in verdict on CheckMySource reflects reports about sign-in problems, locked accounts and suspicious behavior for that specific site.

Check the site you are about to use

Type a website and see what people reported about logging in, paying, uploading files and writing notes. No account needed.

Look up a site

Common questions

How do I know a login page is real?
Check the address yourself, preferably reach it from a bookmark, and see whether your password manager offers to fill it.
What should I do after entering my password on a phishing site?
Change the password immediately on the real site and anywhere else you used it, enable two-factor sign-in and review recent account activity.
Are passkeys safer than passwords?
Yes. A passkey works only on the real site it was created for, so it cannot be handed to a look-alike page.

More guides

General information, not legal or financial advice. Ratings on CheckMySource report what people said; they are not audits. How ratings work.