Most account theft does not look like hacking. Nobody brute-forces your password — you type it yourself on a page that looks genuine. This is phishing, and neither the length nor the uniqueness of the password helps: you hand over the secret voluntarily.
Signs you cannot rely on
The padlock in the address bar. It only means the connection is encrypted, not that the owner is honest. A certificate for a fake domain is free and takes five minutes, and the vast majority of phishing pages run over HTTPS today.
Appearance. The copy is made by saving the real page, so it matches pixel for pixel.
Correct spelling. Errors are a mark of mass mailings. A targeted message is written carefully, or simply copied from a real one.
The sign that works
There is one: the address in the browser bar. Everything else is free to fake; the domain is not.
Look at the end of the address before the first slash — that is the real domain. Common tricks:
bank.com.secure-login.net — the real domain is secure-login.net.
bank-com.net — a hyphen instead of a dot.
bankofamerlca.com — a lowercase L pretending to be an i.
аpple.com — the first letter is Cyrillic.
The last two are nearly indistinguishable by eye, which is exactly why checking visually is unreliable.
What actually protects you
A password manager. The most underrated anti-phishing tool. It fills a password only on the domain it was saved for. On a fake page the field stays empty — a warning that fires before your attention does.
A hardware key. It verifies the domain cryptographically and simply does not answer a stranger. It is the only second factor resistant to phishing: an app code or an SMS you can type into a fake page yourself, and it gets relayed to the real service in real time.
The habit of not following links from messages. Need the bank — open it from bookmarks or type the address. The message may be genuine, but checking that from within the message itself is pointless.
If the password is already typed
Act in the first minutes, before the attacker settles in.
1. Change the password on the real site, reaching it yourself rather than through the link.
2. End all sessions — “sign out of all devices”.
3. Check that the phone number and recovery address were not changed.
4. If the same password was used elsewhere, treat it as a leak.
5. A typed second-factor code expires quickly, but a session may already be open — which is why step 2 is mandatory.