The Bank Login Page That Wasn't

A reader sent us this:

"After I nearly fell for one of those fake bank text messages last year, my son set up Adless on my browser. Last week it blocked a site that looked exactly like my bank's login page but wasn't. I would never have spotted that myself."

That last sentence is the honest one, and it is true of nearly everybody — including people who work in technology. The advice to "check the address bar" quietly assumes a task humans are bad at.

Why looking carefully does not work

A copied bank page is usually a perfect copy, because it is literally the bank's own HTML, images and stylesheet saved and re-hosted. There is no blurry logo to notice. The only difference is the address, and addresses are engineered to survive a glance:

• One character off — a lowercase L where a 1 belongs, or rn where m belongs. At normal text size these are the same shape.
• The real name in the wrong place — yourbank.secure-login.example.com reads as "yourbank" to a person and belongs entirely to example.com to a browser.
• Letters from another alphabet — some Cyrillic characters are pixel-identical to Latin ones.
• A padlock that means nothing relevant — the padlock says the connection is encrypted, not that the site is your bank. Scam sites get certificates too, free, in minutes.

And the reader's own framing gives away why it works: the page arrives after a text message about your bank. By the time the page loads you are not evaluating it — you are already worried, and the page is the reassurance you were looking for.

What catches them instead

Three different mechanisms, because no single one is enough:

The list. Most phishing pages are reported within hours. Adless downloads a large list of known scam addresses to the computer and checks each page against it locally — so a site already reported by someone else is stopped before it loads. This is in the free version, and it is what catches the majority.

The address itself. For a site too new to be on any list, Adless can look at the address for the patterns above — a well-known brand's name appearing in an address that brand does not own, or characters swapped for look-alikes from another alphabet. A warning needs two independent signals at once, never one, so an ordinary page that happens to mention a brand is not flagged. This is a Pro feature.

The moment before you type. The Credential Sentry watches for the specific moment a password is entered into a page impersonating a brand's sign-in, and warns then — the last point at which the outcome can still be changed. Also Pro.

All three run on the computer itself. Checking a page costs no network request, and no address is transmitted in order to check it.

The rule that beats all of this

Software should be the second line, not the first. The habit that defeats the entire category costs nothing:

Never reach your bank through a link. Ever.

Not from a text, not from an email, not from a search result. Type the address yourself, or use a bookmark you made, or the bank's own app. A message that is genuinely from your bank will still be there after you have logged in the safe way — and a message that is not loses its only weapon, which is the link.

If you have already typed details into something that turned out to be fake: ring the bank on the number printed on your card, not any number in the message. Say what happened. They deal with this daily, and speed matters far more than embarrassment.