3 ms·

I'm not sure what actual security risk you're talking about here. I click the magic link, expecting it to sign me in, but instead it takes me to a fake copy of

• OJFord 4y ago
  Yes, a lot of people will fall for that.
• pritambaral 4y ago
  > but instead it takes me to a fake copy of the website ... This is fine, but ... > ... which then asks (again) for login details? This is where the trick lies. The third-party copy doesn't have to ask you for login details. As your parent states: They get redirected to a pay processing site that looks just like the one from their bank, but steals their money and/or identity instead. The fake site doesn't have to show you details of your account. It has to look just similar enough that enough people will think it's a legit payment site and submit their payment details. ---- There's also a simpler, alternative attack I mention in a sibling comment: https://news.ycombinator.com/item?id=32081724 https://news.ycombinator.com/item?id=32081724