Phishing and Fake Login Pages

What phishing is

Phishing is an attempt to trick you into giving away your login details, verification codes or card data. The scammer copies the look of a real website, app or support account, then waits for you to type your password into it.

In trading, a phishing scam on a trading account usually aims at your broker login, your email or your payment details. With those, a scammer can withdraw funds, change your payment details or lock you out.

How a fake broker login page works

A fake broker login page looks almost the same as the real one: same logo, colours and form. The difference is the address and who receives what you type.

Common ways you are led to it:

• A link in an email or SMS saying your account is "suspended", "unverified" or "due for review".
• A sponsored search result or ad placed above the real site.
• A link sent by a "support agent", "account manager" or "mentor" in WhatsApp, Telegram or social media.
• A copied app or website that imitates a known broker. See Clone Sites and Fake Apps.

After you log in on the fake page, it may show an error or forward you to the real site, so you do not notice anything happened.

Signs of a fake login page

• The address is slightly wrong. Extra letters, swapped letters, a hyphen, a different ending or a long subdomain in front of a known name.
• You arrived through a link you did not ask for. Real account problems can be checked by opening the site yourself.
• Pressure and urgency. "Log in now or your funds will be frozen" is a classic phishing line.
• It asks for more than a login. Real login pages do not ask for your card PIN, your full card number or your email password.
• It asks for your verification code by chat. No genuine support team needs the code sent to your phone or app.
• Small mistakes. Odd spelling, broken menus, or links that all go to the same page.

A padlock icon in the browser only means the connection is encrypted. Fake sites can have one too.

Fake support accounts

Scammers also pose as support staff. They may message you first after you post a question in a public group, or create profiles with a broker's name and logo.

Treat these as warning signs:

• Support contacts you first in a private chat.
• They ask for your password, verification code or screen sharing.
• They ask you to send money to a personal wallet, bank account or mobile wallet to "unlock" or "verify" your account.
• They offer to trade for you or promise profits. See Fake Signal Groups and Scam Warning Signs.

Use only the contact options listed on the official website of your broker, reached by typing the address yourself. The SECP advises the public to contact licensed brokers only through their official communication channels.

Bookmark the real address

The simplest way to avoid phishing is to stop clicking links to log in.

1. Type the official address carefully once and check it.
2. Save it as a bookmark in your browser.
3. Log in only through that bookmark or through the official app.
4. Install trading apps, including MetaTrader, only from the official app stores or the official site. See Platforms and apps.

If you use Exness, our Login page explains the official ways in; confirm current details in the Exness personal area or on the official site.

Turn on two-factor authentication

Two-factor authentication adds a second check after your password, usually a code from an authenticator app or an SMS. A stolen password alone is then not enough to log in.

• Prefer an authenticator app where it is offered.
• Never share the code with anyone, including "support".
• Protect your email account the same way, because password resets go there.

More detail: Two-Factor Authentication.

If you entered your details on a fake page

1. Open the real site through your bookmark and change your password.
2. Change the email password if it was the same.
3. Turn on two-factor authentication or reset it.
4. Contact the broker through its official channels and ask them to check recent activity and payment details.
5. Tell your bank or wallet provider if you shared card data.
6. Report it. See Report a Scam.

Be careful with anyone who later offers to "recover" lost money for a fee. See Recovery Scams.

Check who you are dealing with

Phishing often goes together with unlicensed platforms. In Pakistan, the regulator is the Securities and Exchange Commission of Pakistan (SECP), with trading in listed securities and commodities only via SECP-licensed securities and futures brokers. Also, per the SECP, lists of licensed brokers are on the PSX and PMEX websites.

Also, per the SECP, offshore platforms have no Pakistani licence or oversight and offer no legal protection or recourse. That affects what you can do if something goes wrong. Before you open an account, read Verify a Broker and Law and regulators.

Even on a genuine platform, leveraged forex and CFD trading can lose money fast. Account security protects your access, not your trades.

Frequent questions

How can I tell if a login page is fake?

Check the address letter by letter, and ask how you got there. If you arrived through a link in a message or an ad, close it and use your own bookmark.

Will a real broker ask for my password or code in chat?

No genuine support team needs your password or verification code. Anyone asking for them should be treated as a scammer.

Is a site with a padlock safe?

Not by itself. The padlock means the connection is encrypted, not that the site belongs to the company it imitates.

Does two-factor authentication stop all phishing?

It blocks many attacks that use stolen passwords, but a fake page can still ask you for the code. Never type or share a code outside the official site or app.

Where should I download trading apps?

Only from the official app stores or the broker's official website. Avoid files or links sent in chats.