Veriff's Deputy CISO explains how look-alike domains work and six habits that help people and businesses stay ahead of them
New York, Oct. 22, 2026 (GLOBE NEWSWIRE) -- In the light of this year's Cybersecurity Awareness Month, Veriff, an enterprise identity verification platform, is drawing attention to a simple but persistent threat: typosquatting. Attackers register web addresses that are misspelled or closely resemble well-known sites, then wait for a typo or an unnoticed link to bring visitors to them.
Typosquatting, also called URL hijacking, is growing in both scale and sophistication. Tens of thousands of malicious look-alike domains are detected on a daily basis, and large brand domains are among the most frequent targets. The goals vary: capturing usernames and passwords through a copy of a real login page, delivering malware, earning revenue from accidental traffic, or damaging a brand by hosting misleading content under a similar name.
What look-alike domains look like
Using Veriff's own login address as an example, attackers typically rely on a handful of tricks:
- Transposed or missing letters, such as "verirf" or "verif"
- Doubled letters, such as "verriff"
- A different top-level domain, such as .co in place of .com
- An added word, such as "-login"
- Homoglyphs, where characters from other alphabets look identical to Latin letters
Six habits that make a difference
Veriff's Deputy Chief Information Security Officer (CISO), Viljar Bauman, recommends:
- Check the address before you sign in. Look for swapped letters, extra characters or an unfamiliar domain ending.
- Use bookmarks or a trusted search engine for sites you visit often, such as your bank or email, rather than typing the address.
- Be cautious with links in unexpected emails and messages. Go to the official website directly instead.
- Look for HTTPS and the padlock, but don't rely on them alone. Malicious sites can obtain security certificates too.
- Use a password manager. It fills in credentials only on the exact, correct domain, so it won't offer them on a look-alike.
- Use single sign-on (SSO) for work tools. Credentials are entered only on the official identity provider's page, so a fake site can't collect them.
"Every character in a web address matters. A few seconds spent checking the URL, or letting a password manager check it for you, can stop credential theft before it starts," says Bauman.
Organizations can add to these personal habits by monitoring for look-alike registrations of their own domains and by standardizing on SSO, so that employees have one official place to sign in.
About Veriff
Veriff is an AI-native enterprise identity platform that helps organizations build trust online. Leading companies across financial services, marketplaces, mobility, gig economy, and other digital sectors rely on Veriff's technology to stay compliant, prevent fraud, protect users, and scale globally.
Veriff's trust infrastructure supports the full customer journey, from verification to ongoing authentication and fraud prevention, with the least friction for honest people. Built for global scale, Veriff helps businesses expand across borders without the complexity of managing identity verification, compliance, and fraud in multiple markets - creating a single source of truth for trusted identities.
Veriff press@veriff.com
