“I Typed the Address Right — I Swear”: The One-Letter Trick That Still Works

For Young Adults (21–32)

You’re checking out on a shopping site you’ve used a dozen times, or logging into your bank from a link a friend texted you, and everything looks exactly right — the logo, the layout, the little padlock icon. Except one letter in the web address is swapped, doubled, or missing, and the site you’re actually standing on has nothing to do with the company whose name it’s wearing.

This trick — buying up addresses that are one typo away from a real site — has worked since the earliest days of the internet, and the reason is almost embarrassingly simple: our brains read words by shape, not letter-by-letter, especially when we’re moving fast on a phone. A scammer doesn’t need you to be careless. They just need you to be in a hurry, which, in your twenties, is most of the time.

What’s changed is the speed of the disguise. From a legacy sense, building a convincing fake storefront used to take real design time. Now, a passable clone of a real site’s checkout page can be generated in minutes, complete with matching fonts and product photos, and deployed the same day the lookalike address gets registered.

This FTC video walks through exactly this category of lookalike trap, in the setting most people actually get caught in. Believe it or not, it happens more often than you'd think. In the home, mid-scroll, mid-checkout. Take a quick look at this video demonstration: Phishy Home: Avoid Phishing Scams (FTC)

Your actual defense:

1.          Before entering a password or card number anywhere, glance at the actual address bar — not the logo, not the layout, the literal text. A cloned page can nail the artwork. It cannot own the real domain.

2.          Bookmark the sites you use for money — banking, primary shopping, subscriptions — and use the bookmark instead of retyping or clicking a link, especially from texts and social ads. This alone removes almost the entire typo-window a scammer is counting on.

3.          Slow way down on links from ads, especially “flash sale” or “your account has an issue” style urgency. Legitimate retailers rarely create real-time pressure that requires clicking through a shortened or unfamiliar link right now.

4.          If a checkout page ever asks for information a normal purchase wouldn’t need — your Social Security number, a bank transfer instead of a card — stop entirely. 

That’s not extra security. That’s the tell.

None of this requires becoming distrustful of the internet in general. It just means treating the address bar with the same quick glance you’d give a receipt before signing it — a two-second habit that closes a decades-old trick almost completely.

_________________________________________________________________

This post is part of a series inspired by and meant to complement AI Safety for the Everyday User (In 10 Easy Steps) by Terrence “TerrenceTech” Williams — a plain-language guide covering sixteen classic scams and the ten concrete habits that stop them. The full book goes deeper into the “why” behind each one and lays out a complete, step-by-step action plan.