Homoglyph links break the URL check most phishing training teaches

The habit under pressure is the one every awareness module can measure: hover over the link and read the address before clicking. Jake Moore, global security adviser at the cybersecurity company ESET, said: "We've spent years telling people to check the website before trusting it but the problem with this technique is that you can do exactly that and still be fooled as it can look as it should." ^[10]

Moore said the link typically leads to a site that encourages the visitor to enter credentials for the real site, including username, password and even a one-time passcode ^[11]. The Guardian's remedy list ends with two-factor or multifactor authentication ^[14]. Both statements are in the same piece, and the second sits inside the first: where the second factor is a code the user types, the page that collected the password collects that too ^[1].

Whether a substitution can be detected depends on the renderer. The Guardian notes that some fonts make substitutions almost impossible to detect, and that a Cyrillic a in an email address set in comic sans does not look out of place ^[15]. Detection rates from one mail client's default font therefore do not carry over to another client ^[2].

Marijus Briedis, chief technology officer at NordVPN, put the operative variable in the user's state. "The goal is to create a sense of panic so you don't look too closely at the URL. They're betting that when we're in a rush, our brains see what we expect to see," Briedis said ^[9]. Moore's substitute control removes the decision from the moment: "If any text, WhatsApp or email is asking you to log in anywhere, it is vital that you independently visit the genuine website rather than trusting the link in front of you to save a few seconds," he said ^[12].

Independent navigation is paid for in seconds on every login, by everyone. It only works when it applies to the legitimate messages too, since staff cannot sort genuine from spoofed before they navigate. The Guardian's advice points at the browser, saying an updated browser flags suspicious websites and catches the criminals' latest workarounds ^[13]. An operator can require a current browser but cannot tune it.

Moore's assessment is that the technique is becoming increasingly popular, and the piece gives no incidence figures ^[16]. The decade question is whether a person reading characters stays in the control set at all. On this record only two controls work without that reading: independent navigation, and a current browser. The Guardian set a Cyrillic character in place of the Latin a in its own headline to make the point ^[17].