You’re entirely right! Anyone can say anything on the internet and claim its authencity. The prettier the page and the more professional it appear, the more likely they are to be ‘bought’ as real.
It’s pretty hard now to gleen the good seed from the shaft! That’s also why so many thieves use e-mails that even use specific logos from institutions we typically use and phish information as well as accounts that they in turn steal.