Also, a password manager that is built into the browser can give hints(sometimes subtle) that the site isn't who is says it is because the password/user id is tied to the domain