The padlock was displayed — doesn't that prove anything?

Nothing about the site's honesty. The padlock indicates the connection is encrypted, meaning nobody can read what you send — including when you send it to a scammer. Certificates are free and automatic, so a fraudulent site has one too.

I entered my two-factor code — was it useless?

It worked, but for the attacker's benefit: some pages relay what you enter to the real site live, which validates the attacker's own login. That's why a physical security key, which checks the domain before responding, resists where an entered code cannot.

Fake website

In plain terms

A copy of a site you know, often pixel for pixel. It's not trying to fool you for long: just long enough for a login form or a payment.

Definition

A fake website is a reproduction of a legitimate service, hosted on a domain controlled by the attacker, whose function is to collect whatever the visitor enters there.

How it works

The copy is technical and immediate: the code of a public page can be pulled down with a single command, and the resulting appearance is identical because it literally is the same. The certificate that displays the padlock is obtained for free in minutes for any domain, including a fraudulent one — it attests to encryption, never to identity. The site is then reached through a link, an advertisement, or a paid search result. Some versions relay what you type to the real site in real time: the two-factor code you enter is immediately replayed there, the login genuinely succeeds, and you see nothing abnormal — which is what makes appearance useless as a criterion.

Warning signs

Domain different from the expected one, even by a single character
Page reached from a link, an advertisement, or a sponsored result rather than a bookmark
Password manager not offering to fill in the form
Secondary functions of the site missing or redirecting to the real site
Request for information the service never asks for at this point
Login page opening in a window that imitates the browser without being one

How to verify

Don't judge the page, judge the domain — and if you need to log in or pay, don't judge anything at all: close it and reach the service through a bookmark or its app. Your password manager's behavior is the most reliable signal, because it associates your credentials with the real domain rather than the appearance.

What to do

Don't enter credentials or banking details on a page reached from a link. Save a bookmark for each sensitive service and get into the habit of only using that one: it's the habit that makes the quality of the copy irrelevant.

If it already happened

Immediately change the password of the affected service, from a session opened by your own means, then revoke active sessions — a session relayed in real time stays open after the password change. If banking details were entered, block your card. Then check the account's recovery methods.

Frequently asked questions

The padlock was displayed — doesn't that prove anything?: Nothing about the site's honesty. The padlock indicates the connection is encrypted, meaning nobody can read what you send — including when you send it to a scammer. Certificates are free and automatic, so a fraudulent site has one too.
I entered my two-factor code — was it useless?: It worked, but for the attacker's benefit: some pages relay what you enter to the real site live, which validates the attacker's own login. That's why a physical security key, which checks the domain before responding, resists where an entered code cannot.

Official sources

Cybermalveillance.gouv.fr — Phishing (French government cybersecurity assistance service)

This article is part of the Website and browser attacks family. Last updated: 2026-09-02.