Use a clean starting point
Type the service's main website or open a bookmark you created earlier. Avoid links in password-reset messages, invoices, direct messages, shared documents, and account-lock alerts until you have verified them independently. Search results can help locate a company, but sponsored placements and lookalike domains mean you must still inspect the destination.
Read the address from right to left
In accounts.example.com, the registered domain is example.com. In
example.security-check.com, the registered domain is security-check.com. Attackers
place brand names where hurried readers notice them first. Reveal the full address bar on a phone and watch
for extra words, swapped letters, or unfamiliar endings.
Understand normal redirects
Some products use a separate official account host or an organization identity provider. Start the journey from the verified product domain and observe each handoff. If an employer controls the account, use the route supplied by the employer rather than a page found in a general search.
Use tools that remember the domain
A password manager usually offers a saved credential only on matching domains. A passkey or FIDO security key can cryptographically verify the site identity. Neither replaces judgment in recovery or account-change flows, but both reduce reliance on visual inspection.
For a destination you do not recognize, start with the privacy-preserving security tools and choose the link checker or header analyzer that fits the evidence you actually have. The tools do not request an account password or verification code.
Follow the checklist
- Start with the service's known main website, not an email or advertisement.
- Open the site's own navigation and choose Sign in, Log in, Account, or Security.
- Read the registered domain immediately before the top-level suffix.
- Bookmark the verified destination and let a password manager remember the domain.
- Stop if the page asks for a code or approval you did not initiate.
If you already entered information on a suspicious page, secure the real account from a trusted device, change reused passwords, end unfamiliar sessions, replace exposed recovery codes, and review connected apps.