How does typing in your password make you vulnerable to phishing?

When do you authenticate someone in the physical world?

What question should you be asking yourself more often?