A few key things that distinguish fake websites from real, legitimate sites:
Fake:
www.paypaI.com (with an uppercase I instead of L)
Uses slightly misspelled or altered domain name
Uses hyphens or extra words not found in real domain
www.bankofamerica.co (with .co instead of .com)
Uses alternate top-level domain not used by actual company
Real:
Domain matches company exactly
No extra hyphens/words
Uses .com top-level domain
The subtle typos, hyphen additions, or domain differences are specifically meant to trick and mislead unsuspecting users. But by taking care to know the exact, real website addresses and double-checking URLs carefully before entering any sensitive information, it is easy to avoid falling victim to sophisticated fake sites and phishing scams.