ScamSmarts

Adversary-in-the-middle phishing

Proxy pages that relay your real sign-in and steal the session; MFA alone does not save you.

How to spot it

  • Sign-in reached from an email link
  • Domain is not the provider's

What to do

Reach sign-in pages by bookmark; MFA does not make a bad link safe.

What the real thing looks like

  • Signing in by typing the address yourself

Try an example

A practice example with fictional companies. Answer it, then see the tells.

Is this website a scam or legit?

Secure connection (padlock)Address: https://login.microsoftonline.com.secure-verify-account.example/signin
Page title: Sign in to your account

Sign in

Use your Microsoft account. After you sign in, approve the prompt on your phone.

EmailPasswordSign in
Your answer
How sure are you?

Sure and right: +15. Sure and wrong: -5. Calling a legitimate item a scam counts as a miss.

Test yourself on eight more

The free quiz mixes scams with legitimate messages, like real life. No sign-up.

Sources