A fake support portal is a counterfeit website — a fake login, support, or verification page — built to look like a trusted service so visitors enter credentials, codes, or payment details that flow straight to the attacker. It is the capture surface at the end of most phishing chains: the email, text, ad, or search result is only the lure; the counterfeit page is where the credential is actually taken.
Attackers clone a service’s visual identity — logo, layout, fonts, copy — host it on a deceptive domain (a look-alike, typo-variant, or unrelated name dressed to look official), and often fit it with a valid TLS certificate so the padlock is present. Whatever the victim types is exfiltrated. The page may then show an error, redirect to the real site, or — in adversary-in-the-middle designs — transparently proxy the genuine login to relay the password and the one-time code and steal the resulting session token, defeating many forms of MFA.
The portal’s power is fluency: a page that looks and feels real lowers scrutiny, and users are trained to trust surface cues — a padlock, a familiar logo — that attackers can trivially reproduce. The durable defensive truth: the only trustworthy way to a real portal is a path you control (a bookmark, a typed known address, the official app), never a link handed to you — and the reliable technical guard is a password manager, which refuses to autofill on a domain that doesn’t match the one it saved.