A login page can be completely genuine and still appear inside a malicious interface. That is the core security problem ...