The instant before you type a password is the moment phishing depends on. A quick glance at the address bar to confirm you're on the genuine site — not a lookalike — defeats the credential-harvesting page.
“The address bar can't lie. Glance at it before you type.”