Credentials typed on a copy
Rank two, and the least sophisticated thing in the table. That is not a coincidence: cheap attacks are common attacks.
- How often
- Very common
- Typical size
- The account and its balance
- Recoverable
- Sometimes, if you are fast
- Cost to prevent
- Under a minute per session
Why nothing visible separates them
A copied page is copied wholesale. The layout matches because it was taken from the original, the address opens on the characters you recognise because matching a short prefix is cheap, and it loads faster than the real thing because it carries no traffic and runs no defences.
So every heuristic short of a signature returns a positive. Speed, familiarity, appearance, even the reassuring padlock, are all things a copy reproduces perfectly or beats.
How it reaches you
| Route | Why it works |
|---|---|
| A ranked page | Built honestly over months, then the addresses change. No spam signal to detect because nothing was spammed. |
| A saved address | Yours, retired, now answering under somebody else. Covered at rank four. |
| Handed to you | A forum reply, a message, a friend who never checked either. Where it came from feels like evidence and is not. |
| During an outage | The comparison you would normally run is unavailable, and you are in a hurry. |
What actually settles it
A signature checked against a fingerprint you established independently. It proves two things narrowly and absolutely: that whoever signed held a specific private key, and that the text is unchanged. Nothing else available to you answers the question at all. The procedure is on verify on arrival.
If you already typed
- Get in through an address you verified yourself, not the one you were just using.
- Change the password to something used nowhere else, and change it anywhere you reused it.
- Reset the second factor, saving the new recovery material before closing the page.
- Read the message log before looking at the balance. A stolen account is most valuable as a way to talk to people who trust it.
- Then the balance, last, which is counterintuitive and correct.
If what you handed over was a second factor code rather than a password, assume the session is live right now. That is one of the few places in this table where genuine urgency applies.
What the copy actually collects
- The password, immediately and in the clear, because you typed it into their field.
- The second factor, if you supply one, which is replayed against the real site inside its validity window.
- Whatever you do next. Some copies proxy through to the real site so the session appears to work, which removes the only signal you had.
- Your message history, if the session is live, which is often worth more than the balance.
Why the account matters more than the balance
A stolen account with nothing in it is still valuable, because it can talk to people who already trust it. The most productive use of a taken account is not to drain it but to message its contacts with a plausible request, which is why rank three so often arrives from an account with a real history. Reading the message log before the balance is not caution for its own sake, it is checking whether you have become the source of somebody else's loss.
Where the check has to happen
Before typing, not after something looks wrong. Once credentials are in the field the decision has been made, and everything afterwards is damage control. The whole value of verifying on arrival lies in its position in the sequence, which is also why it is the habit most likely to be skipped: it costs a minute at the exact moment you have already decided you are in the right place.