Fraudsters Deploy Homoglyph Attacks With 2FA-Baiting Fake URLs and Emails

Q: If identical URLs and standard security locks can no longer be trusted, how can you truly verify the website you are visiting?

You cannot verify a site’s legitimacy by the padlock or a glance at the URL alone. HTTPS only means the connection is encrypted; a phishing site can also get a valid certificate. With homoglyph attacks, a fake domain may look identical because it uses Cyrillic, Greek or other Unicode characters in place of Latin letters. The safest check is to avoid the link entirely. Open a new browser window and type the known address yourself, or use a bookmark you created earlier. If a message claims to be from your bank, Microsoft or another brand, go to that company’s official homepage or app directly rather than through the email, text or QR code. If you do inspect the address, check the full domain carefully, not just the page design or the sender name. Watch for strange spellings, mixed scripts, or the “xn--” prefix, which can reveal an internationalized domain encoded in Punycode. Hovering over links can help on desktop, but it is not enough on its own. The strongest protection is phishing-resistant login technology. Passkeys, WebAuthn and hardware security keys verify the real domain before authenticating, making them far safer than SMS codes or one-time passwords, which can still be captured in real time. Keep your browser updated, because modern browsers sometimes expose suspicious lookalike domains. If you may already have entered credentials, change the password immediately, revoke active sessions if available, and contact your bank or relevant fraud authority.

2 articles · Updated · The Guardian · Sep 20

Cybersecurity experts say homoglyph attacks are gaining traction, with fraudsters swapping near-identical characters from other alphabets to make fake URLs and email addresses look legitimate.
Those links usually drive victims to spoof sites that capture usernames, passwords and even one-time passcodes, as phishing shifts away from attachments that security software can more easily scan.
Examples include a fake Microsoft address using a Cyrillic “с” and a Booking.com-style link that replaced a slash with the Japanese hiragana character “ん”.
Experts say the tactic works as a psychological trick: urgent messages push users to react quickly, while some fonts make the substituted characters almost impossible to spot.
Recommended defenses include typing known web or email addresses manually, keeping browsers updated, enabling 2FA or MFA, and changing passwords and contacting banks immediately if details are compromised.