The Padlock Does Not Mean a Site Is Safe — the FBI Says So

For years the advice was simple: look for the padlock. That advice is now wrong, and the FBI says so in as many words. Here is what the padlock actually tells you, what it never told you, and what to check instead.

What the padlock has always meant

The padlock means one thing: the connection between your browser and that server is encrypted, so someone sitting on the same network cannot read the traffic in transit.

That is genuinely useful, and it is why HTTPS became universal. But notice what it does not say. It says nothing about who owns the server, whether the business is real, or whether the page is a copy of your bank’s login screen built yesterday.

The FBI puts the original intent plainly: the lock and “https’ were “supposed to indicate the web traffic is encrypted and that visitors can share data safely”. Encryption in transit was the promise. Trustworthiness never was.

Why the signal stopped working

Certificates used to cost money and involve some verification. Then free, automated certificate authorities made basic HTTPS available to anyone in about ninety seconds, with no check on who was asking.

That was the right decision for the web — it encrypted almost everything. It also handed phishing operators the same padlock your bank has. A criminal registering a lookalike domain gets a valid certificate for it just as easily as a legitimate business does.

So the padlock went from a weak signal to no signal at all. Browsers have followed: several have removed the padlock icon entirely, precisely because users were reading it as a safety endorsement.

What to check instead

The useful check moved from the padlock to the characters immediately to its right — the domain name itself.

1. Read the domain from right to left. The important part is the last two labels before the first slash. In login.yourbank.com.secure-verify.io, the actual site is secure-verify.io. Everything to the left is decoration the attacker chose.
2. Check the top-level domain. The FBI’s rule: look for “misspellings or wrong domains within a link — e.g., if an address that should end in ‘.gov’ ends in ‘.com’ instead”.
3. Do not arrive by clicking. If a message prompted you, open a new tab and type the address yourself, or use a bookmark you made earlier. This defeats lookalike domains completely, because you never see the attacker’s link.
4. Treat a certificate warning as a full stop. The NCSC lists clicking through certificate warnings as a habit to prevent, not a judgement call to make.

Where the padlock still earns its place

Its absence still matters. A site served over plain HTTP in 2026 is either badly neglected or actively hostile, and you should not send anything to it.

So the rule inverts cleanly: no padlock is a reason to stop; a padlock is not a reason to proceed. It is a floor, not a recommendation.

If you already entered something

Act on the assumption it was captured. Change the password on the real site immediately, and anywhere you reused it. If you gave card, bank or Social Security details, the FTC’s instruction is to go to IdentityTheft.gov, which produces a personal recovery plan rather than just recording a complaint.

Report the page. CISA’s sequence is resist, report, delete — report through your mail client’s phishing button, and to the organisation being impersonated through contact details you look up independently.

Sources: FBI/IC3 PSA I-061019-PSA · FTC: how to recognize and avoid phishing scams · NCSC: browser security guidance · FTC: IdentityTheft.gov

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from the FBI’s Internet Crime Complaint Center, the FTC and the NCSC. Security guidance changes; where our earlier version of this page said something different, we say so above rather than editing it out quietly.