My mortgage company uses similar URLs that I always associate with scams. It's something like PayMyMortgage.com or something along those lines.

I had 401k through https://www.yourinvestmentaccount.com/ at one point. So sketchy.

They had a virtual keyboard with only 16 choices of chars to type your password in on there at one point.

Is it https://yourmortgageonline.com/?

That site looks super sketchy.

I've also had benefits through something like "mybenefitsportal.com" or something (made up, I forget the real URL).

I don't understand why companies do this. I completely understand that my health insurance is through "Empire Blue Cross Blue Shield" or whatever. So I expect to go to your corporate website and click "log in". If you think your website is so bad that it will damage your corporate brand... well maybe you should work on that.

If it's an SEO thing, that's also shady. If Bank A has "myonlinebillpay.com" and Bank B has "easyonlinebillpay.com"... how am I going to end up at the right one?

It makes me mad.

It's only a problem if the authority is obscured by an unrelated domain name. If the page was a location on a site with known authority, or a subdomain, it could be validated much more easily. Unfortunately, vanity gets in the way.

Its not just vanity though, in these two cases "the authority" is the industry as a whole, thus many "authorities."

For example:

>OptOutPrescreen.com is a joint venture among Equifax Information Services, LLC, Experian Information Solutions, Inc., Innovis Data Solutions, Inc., and TransUnion, LLC (collectively the "Consumer Credit Reporting Companies").

>[annualcreditreport.com] is maintained by Central Source, LLC. Central Source, LLC is sponsored by Equifax, Experian and TransUnion so you have a single site where you can ask for all three of your free credit reports.

So why can't Equifax, Experian, Innovis, and TransUnion each set up a subdomain to redirect to this domain? Then they can each direct people to their own subdomain, and people can be more sure that the site they end up on is one that the respective company intends them to.

I feel like the lack of this kind of thinking helps keep people dumb about what a URL looks like, so that phishing links like www.bank-of-america--interestpayments.com/your-account/secure.html keep working. The less people are parsing the few domains they really do interact with, in favor of specialty URLs for every little thing keeps it all confusing.