Credential phishing doesn't want your money directly — it wants your login. A message impersonating Indeed, LinkedIn, ADP, or a company's HR portal warns that your account is flagged, expiring, or needs "verification," then links to a page that looks identical to the real thing. Type your password and it goes straight to the attacker, who then drains connected accounts, hijacks your job search, or pivots to your email and bank.
The entire attack lives or dies on one thing: whether you check the URL before you type. Scammers spend enormous effort on look-alike domains precisely because the address bar is where they get caught.
The urgency-and-link formula
Phishing messages manufacture a ticking clock so you act before you think. The link then leads to a domain that's close-but-wrong.
- "INDEED ALERT: your account will be DELETED in 24 hours — verify now."
- "Suspicious login detected. Confirm your identity to keep your applications."
- "Your payroll profile is locked. Re-authenticate to receive your paycheck."
How to read a link like a pro
The real domain is the part immediately before the first single slash. In indeed-secure-verify.com/login, the domain is indeed-secure-verify.com — not Indeed. Attackers use subdomains (indeed.secure-verify.com), hyphens (indeed-login.com), look-alike characters (1ndeed.com), and URL shorteners to disguise this. When in doubt, don't click — open the app or type the official address by hand.
Defenses that actually stop it
Turn on two-factor authentication (ideally an authenticator app or passkey, not SMS) so a stolen password isn't enough. Use a password manager — it won't autofill your credentials on a look-alike domain, which is a built-in phishing alarm. And never reuse passwords across job boards, email, and banking.
Red flags to remember
- Urgent threats: account "deleted," "locked," or "suspended" within hours
- A login link whose domain isn't the real company (check before the first slash)
- Links via SMS from a 10-digit number instead of the platform's shortcode
- Requests to "re-verify" your password out of the blue
- Slightly-off logos, spacing, or grammar on the login page
What to do if you're targeted
- 1Don't click. Navigate to the site by typing the official URL or using the app.
- 2If you entered a password, change it immediately everywhere you reused it.
- 3Enable two-factor authentication or a passkey on the affected accounts.
- 4Report the phishing message to the impersonated platform and the FTC.
Frequently asked questions
How can I tell a fake login page from a real one?
Check the domain in the address bar — the real name is directly before the first single slash. Fakes use subdomains, hyphens, or look-alike characters. A password manager that refuses to autofill is a strong signal the page is fraudulent.
I entered my password on a suspicious page. What now?
Change that password immediately, and change it anywhere you reused it. Enable two-factor authentication, review recent account activity, and watch for follow-on phishing to your email.