THIS LOGIN PAGE is fake.

this login page looks real. that's the problem.

you get an email. it says your account got flagged, click here to verify. you click. the page looks perfect. same logo, same layout, same everything. the only thing off is the url sitting up in the address bar, and even that looks close enough that your brain just skips right past it. that's the whole trick. not fancy code, not some zero day exploit. just betting that you won't actually read the domain.

here's the fix that costs nothing and takes five seconds: stop reading domains left to right. read them right to left instead.

why your brain gets fooled left to right

your eyes are trained to read a sentence and grab the general shape of it, not every letter. when you see something like paypal-secure-login.verify-account.com, your brain latches onto "paypal" at the start and calls it good. done. verified. moving on.

but the part of a domain that actually matters, the part that tells you who owns the site, is the root domain. that's the piece right before the final .com, .net, .org, whatever. everything to the left of that is just a subdomain, and anyone can name a subdomain literally anything they want. "paypal" as a subdomain means nothing. it's decoration.

the command: read-the-domain right-to-left

this isn't a terminal command, it's a mental one, but it works the same way every time. take the url apart from the back:

verify-account.com  <-- this is the actual owner
.verify-account.com <-- everything before the last dot-word is fake dressing
paypal-secure-login <-- decoration, means nothing

so walk it backwards:

find the very last dot in the domain before the path (the slash stuff) starts.
the word right before that final dot, plus the extension, is the real owner. in the example above that's verify-account.com.
everything to the left of that, no matter how official it sounds, was chosen by whoever registered the domain. it's not proof of anything.

do that with the real paypal login and you get paypal.com. clean, one word, matches the brand. do it with the fake and you get some random domain that has nothing to do with paypal at all. that gap is the tell.

watch out for lookalikes too

reading right to left catches the subdomain trick, but attackers also register domains that just look like the real thing at a glance. swapped letters, extra dashes, a zero instead of an o, a different extension entirely. so after you isolate the real root domain, actually look at it letter by letter for a second. paypa1.com and paypal.com are not the same domain even though your eyes want to smooth that over.

a few common patterns to watch for:

extra words tacked on before the real brand name, like secure-chase-login.something.com
a completely different tld, like .net or .info instead of the .com you'd expect
hyphens where there normally aren't any
character swaps that look identical at a glance, especially on mobile where the font is smaller

build the habit so you don't have to think about it

the goal isn't to become paranoid about every link forever, it's to make this automatic. every time you land on a login page, especially from an email, text, or dm, glance at the address bar first and mentally strip it from the right. real root domain. does it match what it should be. that's it. two seconds, every time, no exceptions, even when the page looks legit, especially when it looks legit.

on phones this matters even more because most mobile browsers truncate long urls or hide them after you scroll. tap the address bar to expand the full thing before you type in a password anywhere.

the takeaway

fake login pages don't need to be technically impressive, they just need you to be in a hurry. reading the domain right to left forces you to slow down and look at the one part of the url that can't be faked without actually owning it, the root domain. add on a second glance for lookalike swaps and you've shut down one of the most common ways people lose accounts. it's free, it's fast, and it works on every device you own. teach it to the one person in your life who clicks first and reads never.