Modern phishing pages are pixel-perfect. Assuming you can spot one by bad design, a misspelled logo, or an off-brand color is advice from a decade ago. The tells that still hold up are structural, not visual — they're things a convincing copy can't fake without giving up the thing that makes it convincing in the first place.
Three checks that still work
- The domain, read right to left from the first single slash. accounts.google.com.security-check.ru is a security-check.ru page, not a Google one — everything before the domain is decoration.
- Whether your password manager offers to fill anything at all. A manager that's tied to the real domain simply stays silent on a lookalike, because the saved credential doesn't match. That silence is a stronger signal than anything you'll spot by eye.
- Urgency paired with a login form. ‘Your account will be suspended in 24 hours — sign in to confirm’ is a pattern built to short-circuit the two checks above by making you move before you look.
That second point is worth dwelling on, because it's the most reliable one and the easiest to miss. A password manager doesn't get fooled by good design — it doesn't see the design at all. It matches the credential to the domain, and a domain that's one character off is, cryptographically, a different domain. If you're used to your vault autofilling a login and it suddenly doesn't, that's the moment to stop and read the address bar, not to type the password manually to ‘help it along.’
What to do if you already typed it in
Change that password immediately, on the real site, from a device you trust. If you reused it anywhere else — which is its own separate problem — change it there too. This is also where a vault's reused-password detection earns its keep: a single phished credential only exposes one account when nothing else shares it.