Can a login window inside a web page be fake?

A convincing sign-in popup can be drawn inside a malicious page; verify the real browser address before entering a password or passkey.

Yes. A malicious site can draw a realistic “Sign in with Google,” Microsoft, or Apple window inside the page, complete with a fake address bar. Before entering anything, try moving the popup beyond the edge of the original browser window; a page-drawn imitation cannot leave its tab.

Better yet, close it and open the service from your saved app or a bookmark you created yourself. Password managers and passkeys add another check because they normally refuse to fill credentials on the wrong domain, but still read the real browser address before approving a sign-in.

Why a fake login window is so convincing

Your browser lets a web page draw anything inside its tab, including a copy of a sign-in window with logos and a fake address bar. The giveaway: everything the page draws stays inside that tab, while the real address bar sits outside its control.

What to do, step by step

1. Never enter a password in a login window that popped up from a web page.
2. Close the pop-up and check the real address bar at the top of your browser.
3. Open the service from a saved bookmark or its official app, never a link in the page.
4. Drag the window past the tab's edge; a fake cannot leave its page.
5. A password manager or passkey refusing to fill is itself a warning.