S.M.M.

Stop Manipulating Me · A Field Guide to Psychological Influence

ENTRY No. T14.22
CATEGORY Social Engineering
CLEARANCE Public / Essential
EDITION 01
Dossier · Manipulation Tactic

Fake Support Portals

Digital Lure · Credential-Harvesting Page · Very Common
High Alert
How It WorksSEC 01

A fake support portal is a counterfeit website — a fake login, support, or verification page — built to look like a trusted service so visitors enter credentials, codes, or payment details that flow straight to the attacker. It is the capture surface at the end of most phishing chains: the email, text, ad, or search result is only the lure; the counterfeit page is where the credential is actually taken.

Attackers clone a service’s visual identity — logo, layout, fonts, copy — host it on a deceptive domain (a look-alike, typo-variant, or unrelated name dressed to look official), and often fit it with a valid TLS certificate so the padlock is present. Whatever the victim types is exfiltrated. The page may then show an error, redirect to the real site, or — in adversary-in-the-middle designs — transparently proxy the genuine login to relay the password and the one-time code and steal the resulting session token, defeating many forms of MFA.

The portal’s power is fluency: a page that looks and feels real lowers scrutiny, and users are trained to trust surface cues — a padlock, a familiar logo — that attackers can trivially reproduce. The durable defensive truth: the only trustworthy way to a real portal is a path you control (a bookmark, a typed known address, the official app), never a link handed to you — and the reliable technical guard is a password manager, which refuses to autofill on a domain that doesn’t match the one it saved.

Warning SignsSEC 02
  • You arrived by clicking a link. A login or support page reached from an email, text, ad, or search result rather than a bookmark or typed address.
  • The domain is wrong. A look-alike, typo-variant, or subdomain trick — not the organization's real address. A padlock does not confirm legitimacy.
  • Your password manager won't autofill. A refusal to fill is a strong signal the domain doesn't match the one it saved.
  • A "verify" page asks for a one-time code. Requesting your OTP on a login/verification page is a hallmark of session-token theft.
  • Subtle anomalies. Small layout, copy, or URL differences, or an unexpected certificate warning.
  • The padlock is not a trust signal. The lock means encrypted, not authentic — read the full registrable domain instead.
Frequently Paired WithSEC 03
  • Phishing · T14.2
    The delivery mechanism that drives traffic to the portal
  • Urgency-Based Credential Theft · T14.17
    The urgency lure that routes victims to the page
  • Fake Websites · T24.12
    Confused-with consumer analogue
  • Impersonation · T14.7
    Brand-level impersonation lends the credibility
How the Attack UnfoldsSEC 04
  • Stage 01 · Lure
    An email, text, ad, or search result delivers the link — "your account is locked; sign in to restore."
  • Stage 02 · Counterfeit Page
    A cloned login or "verify" page on a look-alike domain (padlock present) asks for credentials, a code, or card details.
  • Stage 03 · Capture
    What you type is exfiltrated; adversary-in-the-middle designs proxy the real site to relay password and OTP and steal the session token — defeating many MFA forms.
Counter-ProtocolSEC 05
Defense: Navigate independently, check the domain not the padlock, and let tools verify the origin for you.
  • Use paths you control. Reach sensitive sites only via a saved bookmark, a typed known address, or the official app — never a link from an email, text, ad, or search ad.
  • Check the domain, not the padlock. The lock means encrypted, not authentic; read the full registrable domain carefully.
  • Let a password manager guard you. It autofills only on the exact saved domain, so a refusal to fill is a red flag — this defeats look-alike portals structurally.
  • Adopt phishing-resistant MFA. FIDO2/passkeys are cryptographically bound to the real origin and won't authenticate to a counterfeit page — the strongest guard against AiTM portals.
  • Report suspected fakes. Flag them for takedown so the next target never reaches the page.