Real-Time (Reverse-Proxy) Login Phishing
An advanced phishing page relays your login to the real site in real time, capturing your password AND your session — defeating even two-factor codes.
Think a message like this reached you? You can check it right now.
What this scam is
You click a link to a page that looks exactly like a real login. As you type, the page secretly forwards everything to the genuine site and passes back what it shows — so when you enter your password and your two-factor code, the attacker captures the live session cookie and is logged in as you, even though you used MFA. The defense is not entering credentials on links, using phishing-resistant security keys/passkeys, and watching the web address closely.
What it usually looks like
- A perfect-looking login page reached from a link.
- It accepts your password and 2FA code normally.
- The real service seems to work — but the attacker now has your session.
- A web address that is subtly wrong.
Common warning signs
- Logging in through a link rather than the app/bookmark.
- A URL that's close but not exactly the real domain.
- 2FA that 'works' but you didn't initiate the login.
- Unexpected new-device alerts afterward.
Example wording scammers use
“Security check required — sign in to confirm your account: [lookalike link].”
“(The page looks identical to your real login and even accepts your MFA code.)”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- Your live session cookie (bypassing MFA).
- Your password and 2FA code as you enter them.
- Immediate account access.
What to do
- Never log in via links; use bookmarks or type the address yourself.
- Use phishing-resistant security keys or passkeys where possible.
- Scrutinize the exact web address before entering anything.
- Report suspicious login pages.
What to do if you already responded
- Change your password and, crucially, sign out all sessions/revoke tokens.
- Re-enroll MFA and check for new devices/rules.
- Report to IT and at reportfraud.ftc.gov.