This is bugging me for a while now due to the potential security risk it involves.

Basicly by accident I discovered that this code is perfectly valid and works without a problem:

jQuery:

$(document).ready(function(){
    $("#phishingURL").on("click",function(e){
        e.preventDefault();

        window.location = "https://www.stackoverflow.com";
    });
});

HTML:

<a id="phishingURL" href="https://www.google.com">https://www.google.com</a>

Most normal PC users just hover a URL to check if it actually directs towards the website they're expecting. In this type of phishing, you get to see the url you expect, yet you're still redirected to a different website. Ofcourse you can always check the address bar etc. But as I work a lot with older people, I know they're going to fall for this. So is there any way to protect yourself against this besides changing your habits?

This is bugging me for a while now due to the potential security risk it involves.

Basicly by accident I discovered that this code is perfectly valid and works without a problem:

jQuery:

$(document).ready(function(){
    $("#phishingURL").on("click",function(e){
        e.preventDefault();

        window.location = "https://www.stackoverflow.com";
    });
});

HTML:

<a id="phishingURL" href="https://www.google.com">https://www.google.com</a>

Most normal PC users just hover a URL to check if it actually directs towards the website they're expecting. In this type of phishing, you get to see the url you expect, yet you're still redirected to a different website. Ofcourse you can always check the address bar etc. But as I work a lot with older people, I know they're going to fall for this. So is there any way to protect yourself against this besides changing your habits?

Edit: Technically it's possible to use Flash on the pshishing site itself and change the browser address bar with SWFAddress.setValue(), making it even possible to make the address bar appear as if it's on the right website.