I wholeheartedly agree with the "similar looking domains" thing. They should just use a subdomain.

If I'm used to visiting "capitalone.com" - and the site to activate a new card is something like "activatecapitalone.com" - that seems sketchy. It should be capitalone.com/activate or activate.capitalone.com -- I tend to simply avoid sketchy sites even if they appear to be from official sources.