You can‘t really, though. Many people have been fooled by fake URL‘s. Nobody checks the cert. To say nothing of the non-human-readable token URL‘s in emails. P

You can‘t really, though. Many people have been fooled by fake URL‘s. Nobody checks the cert. To say nothing of the non-human-readable token URL‘s in emails. Password managers and hardware tokens (Android phones too now) are actually a much better defense against phishing.