Tech-Zone Article
HTTPS: Secure Connection, Not Necessarily a Safe Website
You visit a website. The address begins with https://. Your browser shows a security indicator.
You relax. The connection is secure. Your data is encrypted. Everything looks fine.
Except that you may still be on a fraudulent website.
It is a little like sending a confidential letter in a sealed envelope to the wrong person. The envelope did its job perfectly. The recipient is the problem.
For a CA firm handling client information, tax credentials, financial records and payment instructions, this distinction is more than a technical detail. It is a practical cybersecurity concern.
What HTTPS Actually Does
HTTPS stands for Hypertext Transfer Protocol Secure. It uses TLS (Transport Layer Security) to protect communications between your browser and a website.
It provides three important protections:
- Encryption: Helps prevent outsiders from reading the information exchanged between your browser and the website.
- Data integrity: Helps prevent information from being altered undetectably while travelling between the two ends.
- Domain authentication: Confirms that the server presents a valid certificate for the domain shown in the address bar.
These protections are essential. Without HTTPS, sensitive information exchanged over a connection may be exposed to interception or tampering.
However, there is an important distinction. HTTPS authenticates the domain, not the organisation you think that domain represents.
A fraudulent website can obtain a valid TLS certificate for its own domain. The connection can be properly encrypted even when the website exists solely to steal your credentials.
HTTPS does not, by itself:
- Confirm that a website belongs to the government department, bank or company you intended to visit.
- Guarantee that the people operating the website are honest.
- Protect you from phishing or fraudulent payment requests.
- Guarantee that the website is free of malware or malicious code.
- Ensure that information submitted to the website will be handled responsibly.
In short, a secure connection does not make the destination trustworthy.
The fraudster does not need to break the encryption if you willingly hand over your password.
Recent events have also shown that the certificates underlying HTTPS can themselves be compromised or weakly generated. When that happens, even a padlock based on a valid-looking certificate may not provide the protection users assume. This further underlines that a secure connection is only one layer of trust, never the whole story.
Why the Padlock Can Be Misleading
For years, users were taught to look for the padlock in the browser's address bar before entering sensitive information.
Unfortunately, cybercriminals learnt the same lesson.
They began using HTTPS on phishing websites, too. A fraudulent website can have a valid certificate, an encrypted connection, a professional design and a convincing login page.
Everything may look reassuring. That is precisely the point.
Google Chrome replaced the familiar padlock with a more neutral site-controls icon in 2023, partly because many users treated the lock as proof that a website was trustworthy. Other browsers have made similar changes.
The underlying lesson has not changed: a browser's security indicator is not a guarantee that the website is legitimate.
Think of it this way: the padlock can tell you that the conversation is protected in transit. It cannot tell you whether you should be having that conversation in the first place.
How This Can Affect a CA Firm
Let's consider a few situations that could arise in professional practice.
1. A fake GST portal
The genuine GST portal uses the domain gst.gov.in. Suppose a link instead points to home.gst-gov.in. At first glance, the address may look convincing because it contains both “gst” and “gov”.
To understand the difference, it helps to know how domain names work. In an address such as accounts.example.com, accounts is a subdomain of example.com. The main domain is example.com, and the organisation controlling it can create and manage its subdomains.
Similarly, in home.gst-gov.in, home is a subdomain of gst-gov.in. The main domain is not gst.gov.in. The hyphen changes the domain name, and gst-gov.in is entirely different from the genuine gst.gov.in.
This is a hypothetical example of how a look-alike domain can mislead visitors. The address may contain familiar words, but that does not make it an official government website.
A staff member who overlooks this difference may enter login credentials on a fraudulent page.
The connection is encrypted. The credentials may now be in the hands of a fraudster.
The padlock did not malfunction. It was never designed to identify the correct government portal for you.
2. An urgent payment request
An email appears to come from a client, vendor or business associate. It asks for an urgent payment, an invoice download or a document review.
The link opens a polished website using HTTPS.
The logo looks familiar. The language is professional. The request sounds plausible.
But neither the logo nor the encrypted connection proves that the sender is genuine.
A fraudster can copy a logo much more easily than a CA can recover money sent to the wrong bank account.
Verify unexpected payment instructions independently, using a previously established contact number or another trusted communication channel.
3. A seemingly secure client portal
A staff member receives a link to a document-sharing portal and is asked to sign in to access confidential financial statements.
The website has HTTPS, so the staff member assumes it is safe.
But the actual domain belongs to someone else, not the organisation the page claims to represent.
Entering credentials could expose confidential client documents or provide access to a wider collection of information.
A website does not become trustworthy merely because it has learnt how to display a professional-looking login screen.
4. A genuine website that has been compromised
There is another complication. Even a genuine website using HTTPS can be compromised.
Attackers may exploit vulnerabilities, introduce malicious scripts or alter website content. HTTPS does not guarantee that every component of a website is safe.
So there are two separate questions to consider:
- Am I visiting the website I intended to visit?
- Is that website, including its content and functionality, safe to use?
HTTPS alone cannot answer both questions.
What Should You Actually Check?
1. Read the domain carefully
Do not stop at the website's name, logo or security indicator. Examine the actual domain in the address bar.
A website address can contain a domain, subdomains and a page path. To identify the website you are actually visiting, first locate the hostname — the part after :// and before the next /, ? or #. Then check which domain it belongs to.
For example, gst.gov.in.example.com belongs to example.com, not to the GST portal. By contrast, home.gst.gov.in is a subdomain under gst.gov.in.
Do not assume that a familiar organisation's name appearing somewhere in the address makes the website genuine.
For example, gst.gov.in is the genuine GST portal domain. A hypothetical address such as gst-portal-login.in is a different domain, even though it contains familiar words.
Also watch for:
- Misspellings or extra characters.
- Unusual hyphens or domain endings.
- Familiar names placed inside a longer, unrelated domain.
- Subdomains designed to make another website appear legitimate.
The important part is knowing which domain you are actually visiting, rather than merely spotting a familiar word somewhere in the address.
2. Use bookmarks for important portals
For frequently used services such as GST, income-tax and banking portals, save the verified official address as a browser bookmark.
Open the portal through that bookmark instead of following links in unsolicited emails or WhatsApp messages.
If you need to visit a portal for the first time, obtain its address from a trusted, independent source.
A message saying "Click here to log in securely" is not independent verification. It is simply the message asking you to trust it.
3. Beware of Sponsored Search Results
A common habit among office staff is to search for “income tax portal”, “GST login” or “bank netbanking” and click the first link that appears.
Fraudsters exploit this habit by placing paid advertisements on search engines that lead to phishing websites. These ads may appear above the genuine website and can use convincing descriptions, look-alike domain names and HTTPS connections. The “Sponsored” or “Ad” label indicates that the placement is paid for; it does not guarantee that the destination is trustworthy.
Search engines try to filter malicious advertisements, but they cannot catch every fraudulent link. The first result is not necessarily the official website.
For tax portals, banking services and other sensitive platforms, train staff to avoid relying on sponsored search results. The safest approach is to use a saved bookmark for the verified official website. If you need to find a portal for the first time, verify its address independently rather than trusting the position of a search result.
4. Verify unexpected requests independently
If a client or vendor sends an unexpected payment instruction, requests sensitive information or asks you to open an unfamiliar document, verify the request through a separate, trusted channel.
Do not rely solely on the contact details supplied in the suspicious message.
An apparently familiar sender name is not sufficient proof of identity.
A quick confirmation call may take a minute. Investigating a fraudulent payment can take considerably longer.
5. Enable multi-factor authentication
Multi-factor authentication (MFA) adds protection beyond a password. Even if a password is stolen, an attacker may still be unable to access the account.
However, some sophisticated phishing attacks use intermediary websites to capture credentials and relay authentication codes or session information in real time.
Where available, prefer phishing-resistant authentication methods such as passkeys or FIDO2 security keys. These are designed to bind authentication to the legitimate website's identity.
MFA remains valuable, but it is not permission to click suspicious links with confidence.
6. Keep browsers and software updated
Modern browsers can warn users about known phishing and malware sites. Keep your browser and operating system updated, and retain the browser's built-in protection against dangerous websites.
These features reduce risk, but they cannot identify every malicious website.
And if your browser displays a security warning, do not dismiss it merely because the page looks genuine. A convincing logo does not overrule a security warning.
The Professional Takeaway
HTTPS is essential. It protects information while it travels between your browser and a website.
But it does not automatically establish that the website is legitimate, that its contents are safe or that the organisation behind it can be trusted.
Think of HTTPS as protecting the pipe through which information travels. It does not automatically protect the destination at the other end.
For CA firms, this distinction matters whenever staff access tax portals, banking services, client document repositories or payment platforms.
The right question is not merely, "Is this connection encrypted?"
It is, "Am I communicating with the organisation I intend to reach, and is it appropriate to share this information with it?"
HTTPS is a necessary security measure, not a certificate of trustworthiness.
The padlock—or any other browser security indicator—is useful. But it should never be your only check.
After all, you would not hand over your office keys to a stranger simply because they arrived in a locked car. Why trust a website solely because it uses an encrypted connection?
