ScamSmarts

Password managers and autofill

A password manager stores a unique password for each site and offers it only on the site where it was saved, so a lookalike page gets nothing filled in.

How to spot it

  • Your password manager offers no saved login on a page that claims to be a site you use
  • Typing a saved password by hand because autofill did not appear

What to do

When autofill stays quiet, stop and read the address. Open the site from your bookmark or by typing it.

What the real thing looks like

  • The password manager fills the saved login on the real domain
  • Saving recovery codes in the password manager's secure notes

Try an example

A practice example with fictional companies. Answer it, then see the tells.

Tap the part of the address that shows who owns it.

Secure connection (padlock)Address: acmebank-secure.example/login
Page title: Acme Bank sign in

Sign in to Acme Bank

Your password manager shows: no saved logins for this site.

UsernamePasswordSign in

Skip everything up to ://, stop at the first single slash, ignore anything before an @, then read right to left.

Test yourself on eight more

The free quiz mixes scams with legitimate messages, like real life. No sign-up.

Take the free quizTrain your whole team free

Sources