What's the safest way to log in to an online service (e.g. e-banking), and how do you confirm the connection is genuine?

Type the address yourself (or use your own bookmark) — never a link from email — and verify the TLS connection before entering credentials.

Reaching the site safely:

• Type the URL error-free into the address bar and save it as a bookmark; use the bookmark thereafter.
• Never use a link sent by email.
• Don't have other websites or emails open during the session.

Verifying a correct TLS/SSL connection — three signs:

1. the browser shows no error/warning,
2. the address shows https:// and a padlock,
3. the browser shows the correct DNS name (the real domain).

Why this defeats phishing: phishing relies on you clicking their link to a look-alike domain. If you only ever reach the site via your own typed bookmark and you check the real domain name, the fake page never gets your credentials.

Tip: The padlock alone means "encrypted," not "trustworthy" — attackers get certificates too. The decisive check is the domain name.