Here's my logic. The only reason someone would phish you is to get your credentials. That means they don't know your credentials. Thus, if you try to login to their fake website, they can't be sure whether your password is correct or not, so they just let you in. So, if you put in a fake password, but you're still able to log in, that means that the website you visited is definitely a fake. Now, you leave. Phish avoided.

  • That's a lot of assumptions there. "so they just let you in" - into what? If they do not have access to your account, what do they let you in to?
    – schroeder
    Commented Jan 16, 2023 at 8:50
  • Just make sure you only attempt logins after typing in the domain name manually or using a known safe bookmark. Stop clicking links in mail and on social media unless you take appropriate precautions.
    – svin83
    Commented Jan 16, 2023 at 13:16

1 Answer 1


You assuming here that phishing sites will only store your credentials for later use and have no way to immediately verify that the entered credentials actually work.

But there a phishing sites which are basically an alternative frontend to the original site. As "adversary in the middle" they will pass through the credentials to the original site and can thus immediately check if the credentials work. They might even pass through any (domain-independent) multi factor authentication and can thus impersonate you directly even if MFA is enabled. See Ongoing phishing campaign can hack you even when you’re protected with MFA.

Entering fake password into these more sophisticated phishing sites will thus not help. Instead you need to make sure that you only enter the credentials into the real sites. This can be achieved by using password managers which bind the credential to the actually visited domain and by using multi-factor authentication methods which are also bound to the domain like WebAuthn.

  • Or, the more common case where the login page just collects credentials and displays some generic error message no matter what is entered. Therefore the strategy won't work there either since you have no way of determining whether the site is legitimate by the login behaviour.
    – schroeder
    Commented Jan 16, 2023 at 8:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .