Imitation sites: verify more than appearance

In a web address, the host identifies the destination. A brand word in a path or a subdomain of an unrelated host does not make that host the brand’s official site. A padlock concerns the encrypted connection to the displayed origin, not whether it is the organisation you intended.

Use a bookmark or an independently established publisher link. If receiving details change unexpectedly, compare them through a separate trusted channel. A copied logo, familiar colours and a convincing support chat can all appear at an unrelated origin.

Read the complete domain, including spelling and unexpected added words. Reach the destination through an established bookmark or verified source rather than a forwarded offer. A secure connection indicator does not establish that the party receiving your information is the one you intended.

An unexpected request to use a new payment account, install a tool or approve a code deserves independent confirmation. Do not rely on replying to the same sender. Use a trusted contact route already associated with the service and ask about the particular change.

Stop further input and payments. Preserve the address, message and relevant transaction reference. If credentials were entered, use the real account’s established recovery route to change access and review sessions where available. If a bank approval or transfer occurred, approach the bank promptly about the original action.

Do not accept an unsolicited contact offering guaranteed recovery for another fee. A screenshot can support an investigation, but redact unrelated information when sharing it. The contact and support destination should be verified independently of the suspicious page. The next step depends on whether you only visited, entered credentials or actually authorised money movement.