How can I tell whether a sign-in page is the real one?

The safest first move is not to decide based on how convincing the page looks. Treat an unexpected message and its link cautiously. Instead, open the organization’s site or app using a route you already know, and navigate from there to sign-in or account help. CISA’s guidance recommends caution with unexpected messages and links, and checking where a link leads before interacting with it. [S1]

That avoids relying on the message’s button to get you to the account. A logo, familiar colors, or a polished-looking page are not proof that the page is genuine. [S1]

Before opening a link, inspect the destination shown by your device or browser. Focus on the actual address and whether it is the organization you intended to reach—not just a familiar name or logo in the message. If the address is unexpected, confusing, or you cannot confidently identify the destination, don’t continue through that link. Close the message and navigate independently instead. This is a caution check, not a guarantee: visual inspection alone cannot prove a sign-in page is genuine. [S1]

For example, if a message claims to be from “Example Bank,” but you are unsure about its button, don’t guess at the address or use the button. Open the bank’s app you already use, or independently find its official site and navigate to sign-in there. “Example Bank” is a placeholder, not a real institution or URL.

If you have not entered anything, stop. Don’t submit details on a page you reached from a message you were unsure about. Close it, then go to the organization’s official site or app independently and look for its account-help or recovery route.

If you already entered information, avoid using that page again. Independently navigate to the official account site or app and use its official help or recovery channel to ask what steps are appropriate. Don’t follow additional instructions in the same questionable message to “fix” the issue. The supplied guidance supports using official recovery channels, but it does not establish a specific recovery procedure for every organization. [S1]

Use this quick check:

1. Pause if a message unexpectedly asks you to sign in.
2. Don’t use its sign-in button to reach the account.
3. If inspecting a link, check where it leads before interacting; stop if the destination is unclear or unexpected.
4. Navigate independently to the organization’s known official site or app.
5. Start sign-in or recovery from there. If you still have doubts, use the organization’s official help channel.

Worked example: “I got an unexpected account warning. I won’t sign in through its link. I’ll open the app I normally use and check for an account notice there. If I can’t resolve it, I’ll use the app’s official help or recovery route.” This process reduces reliance on an unexpected link; it does not certify any page as genuine. [S1]