The United web site experience is the biggest tire-fire I have ever seen from a F500 company. They literally ask you to use your credentials on multiple different domains, and every menu item seems to take you to a different domain where you are of course logged out.

United is a phisher’s dream target. No MFA possible, and they spam their customers with zillions of login links on dozens of different domains. I’ll bet you can register unitedcardawards.com and get thousands of credentials without even sending out phishing messages!