Phishing and Authentication


Protecting Against Phishing: Recognizing Fake Login Pages

Summary

Phishing attacks, particularly those using fake authentication pages, represent one of the most common and effective methods for compromising organizational and personal accounts. These attacks have become increasingly sophisticated, with fake Google, Microsoft, and other login pages that look nearly identical to legitimate ones. This guide provides practical strategies for recognizing and avoiding phishing attacks, with special focus on credential-stealing pages.

What is Phishing?

Phishing is a cybersecurity attack where attackers impersonate trusted entities to trick you into revealing sensitive information like passwords, credit card numbers, or other personal data. The most dangerous phishing attacks use fake login pages that capture your credentials when you try to sign in.

How Phishing Works

Common Phishing Scenarios

Email-Based Attacks:

Text Message (SMS) Phishing:

Voice Call (Vishing):

Recognizing Fake Authentication Pages

Critical Warning Signs

1. URL / Domain Name Examination (Most Important)

The URL (or domain name) is your most reliable indicator. ALWAYS check before entering credentials:

Red Flags:

Legitimate URLs:

Important: HTTPS (the padlock in your browser) doesn't guarantee safety—phishing sites can have SSL certificates too!

2. How You Arrived at the Page

Suspicious:

Safer:

3. Visual and Behavioral Red Flags

Practical Protection Strategies

Before Entering Credentials: The 3-Check Method

1. STOP - Don't automatically trust

2. CHECK - Verify the URL carefully

3. NAVIGATE - When in doubt, go direct

Password Manager as Defense

Why This Works: Password managers auto-fill credentials ONLY on legitimate sites they recognize. If your password manager doesn't offer to fill in your credentials, that's a warning sign.

Best Practice:

Multi-Factor Authentication (2FA)

Critical Protection: Even if attackers get your password through phishing, 2FA provides a second barrier.

Important Limitation: Advanced phishing attacks can capture 2FA codes in real-time. That's why URL verification remains critical.

Best 2FA Methods:

  1. Hardware security keys (YubiKey, Titan) - most secure, can't be phished
  2. Passkeys (tied to your browser or machine) - act like hardware keys, use machine passwords or biometrics for login
  3. Authenticator apps (Authy, Google Authenticator) - very secure
  4. SMS codes - better than nothing, but vulnerable to SIM swapping attacks

Google/Microsoft-Specific Protections

Google Advanced Protection Program:

Microsoft Security Defaults:

Common Phishing Scenarios and How to Handle Them

Scenario 1: "Someone shared a Google Doc with you"

The Attack: Email appears to be from Google Drive, with link to view shared document. Clicking leads to fake Google login page.

How to Spot:

Safe Response:

Scenario 2: "Unusual sign-in activity detected"

The Attack: Email claiming suspicious activity on your account, urging immediate password change via provided link.

How to Spot:

Safe Response:

Scenario 3: "Verify your email to prevent account suspension"

The Attack: Threatening message that account will be closed unless you "verify" by logging in through provided link.

How to Spot:

Safe Response:

Scenario 4: QR Code Phishing ("Quishing")

The Attack: Email or physical document contains QR code that supposedly leads to login page or verification process. QR code actually goes to phishing site.

How to Spot:

Safe Response:

Email Security Practices

Verifying Email Authenticity

Check the Full Email Address:

Look for Inconsistencies:

Verify Email Headers (Advanced): Email headers show routing information that's harder to fake:

Before Clicking Any Link:

  1. Hover over the link to see the actual URL (don't click yet!)
  2. Read the entire URL carefully
  3. Compare to known legitimate URLs
  4. When in doubt, type the URL manually instead

Resources and Tools

Browser Extensions (Warning Tools):

Website Safety Checkers:

Account Security Checkups:

Safer Authentication: Password Usage Training Framework
Audience: Nonprofit/advocacy staff, mixed tech levels

Format: In-person or virtual, 8–25 participants

Duration: 90 min (or two 45-min sessions)

Facilitator needs: 1Password account + browser extension ready; basic 2FA familiarity

Materials: Slide deck + participant handout (provided)		 Participants will be able to:

•      Explain why passwords alone don’t protect accounts

•      Set up and use 1Password for daily work

•      Enable 2FA on their highest-priority accounts

•      Identify their top 5 accounts and concrete next steps

•      Describe what passkeys are and where to enable them
Session Flow
#  /  Time Module Key Content + Notes
1

10 min		 Why This Matters Opening hook: show of hands on password reuse -- normalize it

Core problem: credential reuse & phishing, not sophisticated hacking

Key stat: compromised credentials in ~40% of breaches (Verizon DBIR 2024)
2

25 min		 Password Managers: 1Password Concepts: master password, Secret Key, Emergency Kit, vaults (5 min)

Live demo: interface tour, save & generate, autofill, 2FA setup, shared vaults (15 min)

Q&A (5 min): prep answer for “What if 1Password gets hacked?”

Have extension installed before the session. Autofill demo doubles as phishing protection explainer.
3

20 min		 Two-Factor Authentication 2FA method ranking: hardware key → authenticator app → 1Password TOTP → SMS

Priority order: email → financial → cloud storage → CRM → social media

Worksheet: participants identify their top 5 accounts (5 min)
4

10 min		 Introduction to Passkeys What passkeys are, why they’re better (no password to steal, phishing-resistant)

Where they work today: Google, Apple, Microsoft, GitHub, PayPal
5

25 min		 Action Plan + Wrap-Up Walk through 3-column plan: This Week / Next 30 Days / Ongoing

Individual reflection: one commitment in next 48 hours (write it down)

Three takeaways, resources, Q&A
Facilitation Principles
Lead with care, not fear: capability over anxiety; overwhelm creates paralysis

Normalize the starting point: reused passwords are the norm, not a failure

Prioritize action: better to leave having done one thing than understood everything		 Don’t let perfect block good: SMS 2FA beats no 2FA; progress over perfection

Right-size to the group: tailor examples to their platforms; pair early adopters with neighbors

Optional extension (30 min): hands-on 1Password install for groups under 15 with a co-facilitator

Google Workspace Under Login Attack: What to Do

A one-page playbook for small and mid-size organizations

Failed logins are normal background noise on the internet. The real question is whether any are succeeding, and whether your accounts are protected if one does.

Step 1: Check if anything got in

Sign in to admin.google.com and go to Reporting > Audit and investigation > Login audit log. Filter for successful logins in the last 30 days. Look for logins from countries no one works in, unfamiliar IP addresses, or dormant accounts.

If you find a suspicious successful login, suspend the account, reset the password, sign out all sessions, and check the user's Gmail for new forwarding rules or filters.

Step 2: Audit your 2FA coverage

Go to Reporting > User reports > Security. This shows you who has 2-Step Authentication (2FA) turned on and who does not. Immediately add 2FA to all accounts without it.

Step 3: Close the biggest gaps, in order

Step 4: Turn on alerts so you find out faster next time

Path: Security > Alert center > Settings. Enable alerts for suspicious logins, leaked passwords, and changed email settings. Route them to an inbox or channel someone actually reads.

If you do only one thing: enforce 2-Step Verification for everyone. It is the single highest-impact change you can make.