3 ways to recognize a spoof website

1. The URL
If you visit a login page, online shopping site, banking or credit card website, make sure the URL in the address bar includes "https". Https doesn't mean that the site is secure. It only shows that site has an SSL Certificate and that the encryption between Client and Site is encrypted. A Phisher can go and buy an SSL Certificate for less than 50 dollars and put it on his phish site.

Client should verify by clicking on the Certificate to make sure that the Certificate belongs to the company who owns the site.

For instance, http://login.abcbank.com/config/login_verify. As you can see from this example, the website does not include the "s" and is therefore unsecured and therefore is a phishing website.

Moreover, if the web link you're visiting contains an IP address (e.g. http://192.135.5.6.anybank.payment12.com), and then it's without a doubt fake website, as no legitimate company would ever direct you to an IP-named webpage.


2. Domain Names
Whilst some phishers use different domain names altogether, others use misspelled domains to trick you into thinking they are legitimate. They either buy a domain name that resembles the actual domain or they will swap letters very cleverly, so that it isn't obvious.

Therefore, it's key that you keep a close eye on the spelling of domain names and not be tricked into clicking on www.mircosoft.com or www.bankofvvalescom

Also look out for variations in domain names. For instance, sites such as http://support.microsoft-security.net are not legitimate. If it actually belongs to Microsoft it will read http://support.microsoft.com

3. The lock icon
If you're at a secure website, you should see a closed padlock icon on the lower right corner of the browser window. The closed lock signifies that the website applies encryption to its personal and financial data.

If you click on it, it will open a window that gives you more details regarding the security certificate. Every company that asks you for sensitive information must have a digital certificate, preferably one from an established certificate authority such as Thawte, Digicert or VeriSign.

Note that many phishers place a fake closed padlock icon on the webpage itself to trick you into thinking the page has a valid certificate.