Domain literacy
One extra letter
can cost you
everything.
Scammers do not need to hack your bank. They just need you to type your PIN into a website that looks close enough. This page teaches you to read a web address the way a fraud investigator does — in a few seconds, every time.
Hover the address below. Scroll for more.
Hover or click each piece of the address above.
The name can be identical. The danger is in the ending.
Hover or click each pair. The name in the middle never changes — that is the whole trick. What changes is the part almost nobody checks.
Four ways a fake address is built
These are the actual mechanics, not just warnings. Understanding how each trick is constructed is what makes it recognisable next time — on WhatsApp, in an SMS, or in an email that looks perfect otherwise.
What the real address actually is
Screenshot this. Save it. The single most reliable way to avoid a fake bank site is knowing the real one before you ever need it under pressure.
- BankGTBank / GTWorld
gtbank.com - BankAccess Bank
accessbankplc.com - BankZenith Bank
zenithbank.com - BankUBA
ubagroup.com - BankFirst Bank of Nigeria
firstbanknigeria.com - Fintech / MMOOPay
opayweb.com - Digital bankKuda
kuda.com - Fintech / MMOMoniepoint
moniepoint.com - Fintech / MMOPalmPay
palmpay.com
These are correct as of verification, but domains can occasionally change after a merger or rebrand. If one of these ever looks different from what an institution announces on its own official social pages, trust the institution's announcement — not this list, and not a link someone sent you.
Before you type your PIN, take five seconds
- 01
Hover, or press and hold, before you click
On a computer, hover over any link without clicking — the real destination shows in the bottom-left corner of the browser. On mobile, press and hold instead of tapping.
- 02
Read backwards from the last dot
The real domain is always the word directly before the TLD at the very end — not the word that merely looks familiar earlier in the address.
- 03
Type it yourself, or use a bookmark
Never follow a banking link from an SMS, email, or WhatsApp message. Type the address you already know, or open a bookmark you saved yourself, months ago, when nothing was urgent.
- 04
Urgency is the tell, not the TLD
Your account will be locked in 1 hour is designed to make you skip every step above. A real bank's security team has never once needed you to panic.
- 05
When unsure, verify through a channel you already trust
Call the number on your card, open the app you already have installed, or visit a branch. Never the number or link the message itself gave you.
Seen a fake domain pretending to be a bank?
Report it here so the next person searching that link sees your warning before they lose anything.