Protection from Phishing in ZZPass

🎣 What is Phishing?

Definition
Phishing is a cyberattack where scammers create fake websites or emails that look identical to legitimate services (like your bank, Apple, Google, etc.) to trick you into entering your username and password.

Common Scenarios:
• Email claiming your account needs verification with a link to a fake login page
• Text message about suspicious activity asking you to "confirm your identity"
• Fake website that looks exactly like the real one but has a slightly different URL
• Social media ads leading to counterfeit shopping or banking sites

Once you enter your credentials on the fake site, attackers capture them and use them to access your real account.

⚠️ Why Phishing is Dangerous

Highly Effective
Modern phishing sites are extremely convincing. They copy the exact design, logos, and layout of legitimate sites. Even tech-savvy users can be fooled.

Wide Impact
If attackers get your email password, they can reset passwords for all your other accounts. A single phishing success can compromise your entire digital life.

Growing Sophistication
Attackers use AI to create personalized phishing messages, making them harder to detect. They may reference recent purchases, know your contacts, or use urgent language to create panic.

Bypasses Traditional Security
Even with strong passwords and two-factor authentication, phishing can capture your credentials as you willingly enter them on the fake site.

🛡️ How Password Managers Help

Passwords Don't Fall for Tricks
Unlike humans, password managers can't be fooled by convincing fake websites. They check the actual domain (web address) and only fill passwords on the legitimate site.

Example:
• Real site: https://www.apple.com
• Fake site: https://www.apple-verify.com

To a human, both might look identical. But ZZPass knows your Apple password is only for "apple.com" and won't offer to fill it on "apple-verify.com" - immediately alerting you that something is wrong.

1️⃣ Domain Matching (Primary Defense)

What It Does
ZZPass only offers to fill passwords on websites that exactly match the domain you saved when creating the password entry.

How It Works:
• When you save a password for "amazon.com", ZZPass remembers the exact domain
• On a phishing site like "amazon-security.com", ZZPass won't suggest your password
• If ZZPass doesn't offer AutoFill on what looks like a familiar site, it's a red flag

Why This Matters
This gives you an instant, automatic warning that you're on a fake site - even before you realize it yourself. If you expect AutoFill to work but it doesn't, stop and check the URL carefully.

→ Learn more about AutoFill

2️⃣ Password Auditing & Breach Detection

What It Does
ZZPass checks your passwords against databases of known compromised credentials from data breaches.

How It Works:
• ZZPass uses secure, privacy-preserving techniques to check if your passwords appear in breach databases
• If a password has been exposed in a data breach, ZZPass alerts you immediately
• You can then change the compromised password before attackers use it

Privacy Note: Your actual passwords are never sent to any server. ZZPass uses cryptographic hashing to check passwords without revealing them.

Access Password Health:
• iOS/iPadOS: Settings → Password Health
• macOS: ZZPass → Settings → Password Health

3️⃣ Strong, Unique Password Generation

What It Does
ZZPass generates cryptographically random, unique passwords for every account, making credential stuffing attacks ineffective.

Why This Protects Against Phishing:
Even if you do fall for a phishing attack and enter credentials on a fake site, the damage is limited:

• Only ONE account is compromised (the one you thought you were logging into)
• Attackers can't use that password to access your other accounts
• You can quickly change just the affected password

Contrast with password reuse: If you used "Summer2024!" for 10 accounts and got phished once, all 10 accounts would be compromised.

→ Learn about password generation

4️⃣ Two-Factor Authentication (TOTP) Support

What It Does
ZZPass can store and generate TOTP (Time-based One-Time Password) codes right in the app, providing an extra layer of security.

How It Protects Against Phishing:
Even if attackers steal your password through phishing, they still need your TOTP code to access your account. Since TOTP codes change every 30 seconds and ZZPass generates them securely:

• Attackers have a very small window to use stolen credentials
• Many phishing sites don't capture TOTP codes effectively
• You'll often get an alert from the real service about a failed login attempt

Note: Some advanced phishing attacks can intercept TOTP codes in real-time, so this isn't foolproof - but it significantly raises the bar for attackers.

→ Learn about TOTP in ZZPass

5️⃣ Browser Extension Verification (Safari)

What It Does
On iOS and macOS, ZZPass integrates with Safari through official Apple APIs (AutoFill Credential Provider), which includes built-in phishing protection.

How It Works:
• Safari validates that websites are legitimate before allowing AutoFill
• Apple's Safe Browsing technology warns you about known phishing sites
• Certificate validation ensures the site is who it claims to be

Visual Indicators:
On macOS Safari, look for the padlock icon in the address bar showing a valid HTTPS connection. If the site can't verify its identity, Safari will warn you before ZZPass offers to fill credentials.

6️⃣ No Automatic Submission

What It Does
ZZPass fills your username and password into the form fields but never automatically clicks the "Submit" or "Login" button.

How This Helps:
This gives you a final moment to review the page before logging in:

• Check the URL in the address bar
• Look for HTTPS and the padlock icon
• Verify the page layout looks correct
• Notice any unusual requests or typos

If anything looks suspicious, close the page immediately and navigate to the site manually by typing the URL or using a trusted bookmark.

🔍 Check the URL Carefully

Common Tricks:

• Misspellings: "applc.com" instead of "apple.com"
• Extra words: "apple-verify.com" or "secure-apple.com"
• Wrong TLD: "apple.co" instead of "apple.com"
• Subdomain tricks: "apple.com.phishing-site.com"
• Similar characters: "g00gle.com" (zeros instead of O's)

How to Check:
1. Look at the domain name immediately before the first single slash (/)
2. Check for HTTPS and the padlock icon
3. Click on the padlock to see certificate details

Golden Rule: If ZZPass doesn't offer AutoFill where you expect it, manually check the URL. Don't type your password.

📧 Suspicious Emails & Messages

Red Flags:

• Urgency: "Your account will be closed in 24 hours!"
• Fear tactics: "Suspicious activity detected - verify now"
• Unusual sender: Email from "apple@service-verify.net" not "@apple.com"
• Generic greeting: "Dear Customer" instead of your name
• Spelling errors: Professional companies don't send emails with typos
• Unexpected links: Links that don't match the company's real domain

Safe Practice:
• Never click links in unexpected emails
• Instead, manually type the company's website address
• Or use a bookmark you previously saved
• Log in to check for notifications directly on the site

🚩 Warning Signs on the Page

Visual Clues:

• Low quality graphics: Blurry logos or inconsistent styling
• Poor grammar: Professional companies proofread their content
• Excessive personal info requests: Asking for SSN, full credit card, etc.
• No HTTPS: Most legitimate login pages use secure connections
• Odd layout: Doesn't quite match how you remember the real site
• Pop-ups: Legitimate sites rarely use login pop-ups

Trust Your Instincts:
If something feels off, it probably is. Close the page and navigate to the site manually through your browser's address bar.

✅ Do This

Use AutoFill as Your Phishing Detector
Rely on ZZPass AutoFill. If it doesn't offer to fill your credentials on a site where you'd expect it to, stop and investigate. This is your early warning system.

Create Bookmarks for Important Sites
Bookmark your bank, email, and frequently-used sites. Always access them through these bookmarks, never through email links.

Enable Two-Factor Authentication
Use TOTP (stored in ZZPass) or hardware security keys for important accounts. This provides backup protection even if passwords are stolen.

Check Password Health Regularly
Review ZZPass's Password Health feature monthly to identify compromised passwords before attackers use them.

Type URLs Manually for Sensitive Sites
For banking and financial sites, manually type the URL into your browser rather than clicking links, even from seemingly trustworthy sources.

❌ Don't Do This

Don't Click Email Links to Login Pages
Even if the email looks legitimate, always navigate to the site independently. Attackers can fake the "From" address.

Don't Ignore AutoFill's Absence
If ZZPass doesn't offer to fill credentials where you expect them, this is a red flag. Don't manually type your password.

Don't Rush
Phishing attacks rely on urgency ("Act now or your account will be deleted!"). Take your time and verify the site's legitimacy before entering credentials.

Don't Reuse Passwords
Use ZZPass to generate unique passwords for every account. This limits damage if you do fall for a phishing attack.

Don't Trust Caller ID
Scammers can spoof phone numbers to appear as legitimate companies. Never provide passwords over the phone, even if the caller ID looks correct.

⚠️ If You Suspect Phishing

Immediate Steps:

1. Stop! Don't enter any information
2. Close the page without clicking anything
3. Check the URL if you didn't close it yet
4. Navigate manually to the real site
5. Report the phishing attempt (see below)

If You Already Entered Credentials:

1. Go to the real site immediately and change your password
2. Update the password in ZZPass
3. Enable 2FA if you haven't already
4. Check for unauthorized activity
5. Notify the company that their brand is being phished

Bank/Financial Phishing

The Scam: Email claiming suspicious activity on your account with a link to "verify your identity."

What Really Happens: Link goes to a fake banking site that captures your credentials and security questions.

Protection:
• Banks never ask you to verify credentials via email
• Always access your bank by typing the URL or using the app
• Call the number on your bank card (not a number in the email) to verify
• ZZPass won't offer AutoFill on the fake site

Package Delivery Phishing

The Scam: Text or email about a package delivery issue requiring you to "update your address" or "pay customs fees."

What Really Happens: Fake UPS/FedEx/USPS sites that ask for account credentials or credit card info.

Protection:
• Tracking numbers can be checked directly on carrier websites
• Never click links in shipping notifications you didn't expect
• Real carriers don't request payment via text message links
• Use ZZPass's domain matching to confirm you're on the real site

Account Suspended Scams

The Scam: Email saying your Apple ID, Google account, or other service will be suspended unless you "verify your information immediately."

What Really Happens: Urgency makes you panic and click the link without thinking, leading to a credential-stealing fake login page.

Protection:
• Apple and Google don't suspend accounts via email threats
• Navigate to the service directly through your browser
• Check Settings on your device for any actual issues
• Notice that ZZPass won't AutoFill on the fake page

Spear Phishing

What It Is: Highly targeted phishing that uses personal information about you to seem more legitimate.

Example: "Hi [Your Name], I'm [Your Boss's Name]. I need you to reset the company password portal for the quarterly review. Here's the link: [fake link]"

Defense:
• Verify through a second channel (call, text, in-person)
• Be suspicious of urgent requests, even from known contacts
• Use ZZPass AutoFill to validate domains
• Don't assume an email is real just because it has correct personal details

Man-in-the-Middle Phishing

What It Is: Attacker intercepts your communication with a real site, capturing credentials in real-time.

Example: You use public WiFi at a coffee shop. An attacker redirects you to a fake login page that forwards your credentials to the real site after stealing them.

Defense:
• Avoid entering passwords on public WiFi
• Use a VPN on untrusted networks
• Check for HTTPS and valid certificates
• ZZPass won't AutoFill if the domain doesn't match exactly

Clone Phishing

What It Is: Attackers copy a real email you previously received and resend it with malicious links.

Example: You get a second "welcome email" from a service you already use, with links changed to phishing sites but everything else identical.

Defense:
• Question unexpected duplicate emails
• Hover over links to check the URL before clicking
• Access services through bookmarks or by typing URLs
• ZZPass's domain matching catches clone phishing attempts