> but instead it takes me to a fake copy of the website ... This is fine, but ... > ... which then asks (again) for login details? This is where the trick li

> but instead it takes me to a fake copy of the website ... This is fine, but ... > ... which then asks (again) for login details? This is where the trick lies. The third-party copy doesn't have to ask you for login details. As your parent states: They get redirected to a pay processing site that looks just like the one from their bank, but steals their money and/or identity instead. The fake site doesn't have to show you details of your account. It has to look just similar enough that enough people will think it's a legit payment site and submit their payment details. ---- There's also a simpler, alternative attack I mention in a sibling comment: https://news.ycombinator.com/item?id=32081724 https://news.ycombinator.com/item?id=32081724