Does entering credentials prove they were captured?¶
Entering credentials into a suspected phishing page does not automatically prove that the offender successfully captured or retained them.
Avoid the dangerous assumption¶
The dangerous assumption is that user entry, transmission and offender receipt are the same event.
They are not.
The information may have been:
- entered but not submitted
- submitted to the wrong or inactive endpoint
- blocked by a browser or security service
- transmitted successfully
- stored by the phishing infrastructure
- relayed immediately to a genuine service
- discarded because of an error.
Investigators should establish what the user entered, whether the form was submitted and what network or server activity followed.
Evidence may exist in:
- browser form history
- network and proxy logs
- website or hosting records
- page source and submission endpoints
- security-product records
- identity-provider sign-in events
- later password changes
- subsequent unauthorised sessions.
The victim’s account is important, but memory may not establish exactly what was transmitted.
Later account access may support an inference that credentials or session material were obtained. It does not necessarily prove that this particular page was the source. Credentials may have been reused, leaked previously or captured by malware.
The offender may also have obtained only part of the authentication material. A username and password may fail where additional controls apply, while captured session material may bypass another login step.
Report the stages separately: entry, submission, receipt and use.
Where the page is still available, preserve it safely and urgently. Do not enter genuine credentials to test it.
Operational takeaway¶
Separate the user entering information from its submission, offender receipt and later use, and corroborate each stage with device, network, website and account records.