← 首页

Spotting Phishing Sites Before You Enter Credentials

Guides · 2026-09-26

Most account takeovers start with a single moment: you type your email address and password into a page that looks like your exchange but is not. The page can copy logos, colours and wording almost perfectly, so appearance alone tells you very little. What helps is a fixed routine you run before your fingers reach the keyboard, every single time, including on days when you are in a hurry. This guide walks through that routine step by step: how to reach a login page from a source you already trust, what to look at in the address bar and page content, how to check whether a message that pushed you there is genuine, what to write down when something looks wrong, and the point at which you should stop and close the tab instead of trying to log in anyway. Treat every unfamiliar link as untrusted until you have verified it through a channel you chose yourself.

Start from a source you already trust, not from a link

The safest habit is to never open a login page from a link in an email, SMS, chat message, social media post or search advertisement. Instead, open a new tab and reach the exchange through a route you have used before, such as a bookmark you created yourself, a saved entry in your password manager, or the address you type from memory. Once you are on the page, check that your password manager recognises the address; if it offers to fill in credentials on a page it has never stored, that is a warning sign worth investigating before you type anything.

If a message claims you must act immediately because of a security issue, a withdrawal request or a locked account, slow down rather than speed up. Urgency is the main tool used to push people past their usual checks. Open the exchange independently and look for the same notice inside your account or in the official help centre. If you cannot find it there, do not continue through the original link; close it and start again from your own bookmark.

A useful rule for readers in Germany and elsewhere: the channel that delivers a link is never the channel that proves the link is genuine. A message can arrive from a familiar name, a real-looking sender address or a group you belong to and still point to a counterfeit page. Verification has to happen somewhere else, on a page you navigated to yourself.

Inspect the address bar and connection details before typing

Look at the full address, not just the first part. Phishing pages often place a familiar brand name in a subdomain or in a path so that the beginning of the address looks reassuring while the actual domain is something else. Read the address from right to left, identify the main domain, and compare it character by character with the address you normally use. Watch for swapped letters, added hyphens, unusual endings and extra words such as login, secure or verify inserted into the domain itself.

Check the padlock and certificate information, but do not treat them as proof. A padlock only means the connection is encrypted; counterfeit pages can also be encrypted. Open the certificate details and see which organisation and domain the certificate was issued for. A mismatch between the certificate holder and the exchange you think you are visiting is a reason to stop.

Also examine the page itself for small inconsistencies: broken images, spelling mistakes, mixed languages, buttons that do not respond, or a login form that asks for more than you expect, such as a seed phrase, a private key, a full card number or a one-time code at the same moment as your password. A genuine login flow never needs your recovery phrase. If any field asks for it, close the page immediately.

Verify the request through the official help centre

When something prompts you to log in, confirm that the request exists on the exchange side. Go to the official help centre and search for the topic the message mentioned, for example a security notice, a verification step or a change to account settings. If the help centre has no matching article, the message is very likely fabricated. Support teams publish guidance on their own pages; they do not ask you to confirm credentials through a link in a message.

Use the same approach for anything that looks like a login page reached from an app, a QR code or a notification. Navigate to the official site yourself, sign in there if you decide to, and check whether the same prompt appears inside your account. If it does, you can act on it from within the session you opened. If it does not, treat the original prompt as unverified and do not return to it.

Be equally careful with pages that imitate the help centre itself. A counterfeit support page can offer a chat window, a form or a phone number and then ask for your login details or a one-time code to resolve your problem. Genuine support does not need your password. When in doubt, close the window and reopen the help centre from your own bookmark.

What to record and when to stop

If you suspect a page is counterfeit, do not try to test it by entering a wrong password; some pages capture whatever you type and use it later. Instead, note the full address, the date and time, how you arrived at the page, and what the page asked you to do. Take a screenshot if you can, without entering any data. These details make it much easier to describe the incident accurately if you later contact support through the official help centre.

Stop and close the tab if any of the following applies: the address does not match the domain you normally use, the certificate details do not fit, the page asks for a recovery phrase or private key, the page requests your password and a one-time code together in an unusual way, or you cannot find the same request inside your account. Closing the page costs you nothing; continuing can cost you the account.

If you have already entered your credentials on a page you now doubt, change your password from a page you reached yourself, review your account security settings, and contact support through the official help centre to describe what happened. Record what you did and when, so the timeline is clear. Afterwards, return to the routine above for every future login and treat any deviation from it as a reason to pause rather than a reason to improvise.

Risk boundary: Germany Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

Related