How Twofold stops phishing sites from stealing your codes
A convincing fake page can ask for your code and use it within seconds. Here is how Twofold tells the real site from a lookalike.
Two-step verification stops most account takeovers, but there's one trick it can't stop on its own: the fake sign-in page. Here's how that attack works and what Twofold does about it.
The attack
You get an email: "Unusual sign-in detected, please verify your account." The link opens a page that looks exactly like your bank. You enter your password, then it asks for your six-digit code. Behind the scenes, the fake site is passing everything to the real bank in real time. A few seconds later, the criminal is signed in as you.
The code was valid, because you typed it yourself. A phone authenticator app has no idea which website you're looking at; it just shows the number.
What Twofold does differently
Twofold lives in your browser, so it can see the address of the page asking for the code. Every account knows which website it belongs to, and Twofold only suggests a code on that website.
It reads the address the way computers do
Attackers rely on addresses that look right at a glance. Twofold looks at the part of the address that actually decides who owns the site:
mybank.com: the real site. Code offered.login.mybank.com: still mybank.com. Code offered.mybank.com.secure-login.net: this is secure-login.net, which only borrows the name. No code offered.mybank-verify.com: a different website. No code offered.rnybank.com: "rn" pretending to be "m". No code offered.- An address using letters from another alphabet that look identical: no code offered.
You can try this yourself with the interactive tester on our home page.
Known brands only match their real domains
When Twofold suggests which website an account belongs to, well-known services are only ever matched with their genuine domains, never with a domain that merely contains the name.
A deliberate second click
Sometimes you genuinely need a code on a site Twofold doesn't know yet, for example a company sign-in page on a different address. You can still choose any account. If it isn't linked to the current site, Twofold asks you to confirm with a second click and shows a warning. That pause is often enough to notice that something is off.
Protection against hidden-button tricks
A more advanced attack, called clickjacking, hides or covers a legitimate button and tricks you into clicking it. Twofold's in-page panel refuses clicks when it has just appeared, or when another page covers it or makes it invisible. It only responds when it's genuinely visible and you clicked on purpose.
Your code never leaves without you
- Autofill is off until you turn it on, and you choose whether Twofold asks first or fills automatically.
- Pages are checked on your device. Nothing about the sites you visit is stored or sent anywhere.
- The secret behind each code stays in your encrypted vault. Websites only ever see the six-digit code.
Even better: passkeys
Passkeys take this protection further: they are built so that a fake website can't use them at all. Where a site offers passkeys, consider using them. See passkeys explained.
Habits that help
- Be suspicious of urgent emails and texts asking you to sign in. Go to the site yourself instead of clicking the link.
- If Twofold doesn't suggest a code where you expected one, stop and check the address.
- Prefer authenticator codes over text messages; here's why.