Fake websites can imitate banks, online shops, streaming services, government departments, social networks and other familiar organisations. They may look convincing enough to encourage you to enter information without thinking twice.
Check the exact domain rather than only the branding on the page. Look for unexpected spellings, extra words, unusual domains or addresses that do not match the organisation you intended to visit.
Think about how you reached the site. An unexpected link in an SMS, email, WhatsApp message or social media post deserves more scrutiny than a site you reached through a trusted bookmark or official app.
Pay attention to what the website asks you to provide. Requests for passwords, PINs, one-time passwords, banking credentials, card information or unusual identity details should make you stop and verify the request.
HTTPS and a padlock indicate an encrypted connection, but they do not by themselves prove that the organisation behind a website is trustworthy.
When unsure, leave the page and access the organisation through its official app or a website address you already trust. If you already entered information, use Get Help for the relevant incident.