Scam library
Fake sign-in pages: how credential phishing works
An urgent account warning, a handy sign-in button, and a page that looks just right.
Short answer
A fake sign-in page copies a real login screen, often Microsoft 365, so that the password you type goes straight to an attacker.
How it works
This one looks like a message from IT or your email service. Your password expires today, there was an unusual sign-in, or your mailbox is full. Click here to keep your account.
The link goes to a sign-in page that looks correct, same layout, same colours. You type your email and password, and now someone else has them.
With your login, a scammer can read your email, send messages as you to coworkers and clients, and use your account to fool everyone you work with.
The one rule
Never sign in from a link in a message you weren't expecting. Go to the site the way you normally would: your bookmark, the app, or typing the address yourself. If something really needs your attention, you'll see it there.
Red flags
- A warning that you'll lose access unless you act now.
- The sign-in link goes to an address that isn't your company's usual one.
- It came from outside your company, even though it claims to be IT.
What to do
Don't click. Sign in the usual way to check. If you already typed your password into a page you now doubt, tell your IT provider right away. Minutes matter, and nobody gets in trouble for it.
This page is taken from the 3 minute NetMinder lesson staff see straight after clicking a practice email about this scam.