Pages that look like two-step setup, passkey renewal or recovery-code checks, hosted on a lookalike domain to collect passwords, phone numbers and codes.
How to spot it
A security page on a domain that is not the company's own
Asking for your password, codes or recovery codes to 'verify' or 'renew' something
Reached from a link in a message rather than from the account's own settings
What to do
Close the page. Open the account by typing its address or using your bookmark, and check its security settings there.
What the real thing looks like
Two-step setup inside the account's own settings, after you signed in on the real domain
An IT announcement that tells you to set up two-step sign-in on your next normal sign-in
Try an example
A practice example with fictional companies. Answer it, then see the tells.