For years people were taught one rule about staying safe online. Look for the little padlock in the address bar, and if it is there, the site is safe. That advice was never quite right, and today it is close to useless. The padlock does mean something real, but it does not mean what most people think. It has quietly become one of the most misread symbols on the internet. Scammers know exactly how much trust it earns, and they use that trust against you.
The padlock stands for a security setup called HTTPS. All it promises is that the connection between your device and the website is scrambled, so no one sitting in the middle can easily read what passes back and forth. That is truly useful. It protects your password from a stranger snooping on the coffee shop wifi. But scrambling the pipe says nothing about who waits on the other end of it. A locked, private tunnel can still lead straight to a thief. The lock secures the road, not the destination.
Here is the part that changed the game. Getting the certificate behind that padlock used to cost money and take effort. Now it is free and automatic, which is great for honest sites and just as great for criminal ones. Studies of phishing pages found that the large majority of them now carry the padlock. A fake bank login built to steal your details will show the same lock as the real bank. The symbol that was supposed to separate safe from dangerous now sits on both. It no longer sorts anything at all.
The people who build browsers noticed. In 2023 the team behind Chrome, the most used browser in the world, quietly removed the padlock icon and swapped in a plain settings symbol. Their own research showed that only a small share of users understood what the lock meant, and that many wrongly read it as a stamp of trust. Rather than keep feeding a false belief, they took the icon away. Other browsers have moved in the same direction. The very symbol people were told to rely on is being retired for causing confusion.
So what should you actually look at? Start with the web address itself, the domain. Read it slowly, from the right side in. The true site name sits just before the first single slash, and scammers stuff their fakes with extra words to fool a quick glance. A link that reads like your bank followed by a string of odd characters and a strange ending is not your bank. Type important addresses yourself or use a saved bookmark instead of clicking links in email. The name is the thing that matters, not the lock beside it.
A few other habits catch most fakes. Be wary of any page that reaches you through a link in a text or email and then asks for a password or payment. Real companies rarely rush you, while scams push urgency, warning that your account will close in minutes. Watch for small misspellings in the domain, swapped letters, or extra dashes. Look at whether the offer even makes sense, because a deal that is too good usually is. None of these checks involve the padlock. They are about the address and the story around it. Trust your gut when something feels rushed or strange. A real company can wait a day for you to check. Scammers cannot, because delay gives you time to think. When in doubt, close the page and go to the site the way you normally would. Reach it through your own bookmark or a search you trust, never the link you were handed. That one habit stops most attacks cold.
Phones make all of this harder, which is worth knowing. Mobile browsers often hide most of the web address to save space, showing only a piece of it. That trimmed view is exactly where a fake name can hide the ugly part of its link. Tapping the bar to see the full address takes a second and is worth the habit. Apps can disguise links even further, wrapping them so you cannot see where a button really goes. On a small screen, slow down before you tap, because the usual clues are half hidden.
The lock was a good idea for its time, when scrambling was rare and worth flagging. That time has passed. Nearly every site uses HTTPS now, honest and dishonest alike, so the presence of a lock tells you almost nothing about trust. The safer mindset is to treat the padlock as the low bar it is, a sign the connection is private, and nothing more. Judge a site by its address, how you got there, and what it is asking you to do. The symbol you were told to trust is not the guard you thought it was.
