Bank of America login URL: the real address

Bank of America's real sign-in page is on secure.bankofamerica.com. If a link takes you anywhere else and asks for your Bank of America password, close it. We opened each address below on 9 November 2026.

Domains Bank of America uses

Not a complete list. Each address below can have subdomains in front of it (www., login.), and they are still Bank of America's.

• bankofamerica.com
• bofa.com

How to read the address

Look at the part between https:// and the first single /. Read it from the right. The real thing ends in bankofamerica.com or another domain listed below, with nothing but a dot before it.

• https://login.bankofamerica.com/… is Bank of America: it ends in .bankofamerica.com.
• https://bankofamerica.com.account-check.example/… is not: it ends in account-check.example, and Bank of America's name at the front is decoration.
• https://bankofamerica-secure-login.example/… is not: a hyphen makes a different domain, and anyone can register one.

Everything after the first / is chosen by whoever made the page, so …/bankofamerica.com/signin in the path proves nothing.

What fake Bank of America pages looked like

On 5 November 2026, PhishTank listed 31 live, verified phishing URLs that its volunteers labelled Bank of America.

• 100% used HTTPS. The padlock means the connection is encrypted, not that the site is Bank of America.
• 0% had "bankofamerica" in the hostname. Most fakes give no such clue, so the absence of Bank of America's name doesn't make a link safe either.
• 71% sat on services anyone can sign up to, such as website builders, file sharing and QR-code links, rather than on a domain the attacker registered.

Hostnames from the same list that use Bank of America's name without being Bank of America's, newest first. Dots are written as [.] so none of them is a working link.

• sbofaeddprepaid[.]w3spaces[.]com

Report a fake Bank of America email or page

Forward suspicious emails or texts that use Bank of America's name to abuse@bofa.com.

Source: Bank of America: Report suspicious activity, checked 9 November 2026.

Lures to watch for

• Many sites repeat abuse@bankofamerica.com; the bank's own page now gives abuse@bofa.com.
• If you entered your details on a page you're unsure about, call the number on your card or statement, not one from the message.

Questions

What is Bank of America's official login URL?

secure.bankofamerica.com (Signing in on www.bankofamerica.com takes you to secure.bankofamerica.com). A real Bank of America address ends in bankofamerica.com, bofa.com, read from the right of the hostname.

How do I report a fake Bank of America email or website?

Forward suspicious emails or texts that use Bank of America's name to abuse@bofa.com.

Do fake Bank of America sites use Bank of America's name in the address?

In PhishTank's list of live phishing URLs on 5 November 2026, 0 of the 31 URLs labelled Bank of America (0%) had the brand's name in the hostname, so most gave no such clue. 100% used HTTPS, so a padlock proves nothing.

How we checked

• Sign-in addresses: opened on 9 November 2026 and followed through every redirect to where the sign-in page loads.
• Phishing numbers: PhishTank's online-valid list, downloaded 5 November 2026. Only URLs its volunteers labelled Bank of America count, and many fakes are labelled "Other", so these are a sample. We didn't open any of them. Data shared under CC BY-SA 2.5; method as in our phishing URL statistics.
• Example hostnames: hostnames in the whole list that contain "bankofamerica" but aren't on Bank of America's domains, one per domain.

See also: official sign-in addresses of 15 brands.

Last updated: 9 November 2026, when the sign-in addresses were checked.