How to spot a phishing link before you open it

To spot a phishing link before you open it, check the real domain (the part right before the first slash), be wary of any message that rushes you, and find out where a shortened link goes before you tap it. No single sign settles it, but together they give you plenty of chances to stop in time. And if you share links with customers or followers, the same clues help you make sure yours never look suspicious.

In short:

• A link’s text can say anything; what counts is the actual address behind it.
• The site’s owner is the domain right before the ending (.com, .org, .net), not whatever appears first.
• The HTTPS padlock means the connection is encrypted, not that the site is legitimate.
• Before opening a shortened link, use the shortener’s preview feature if it has one.
• If you already clicked and typed something in, change that password and call your bank using its official number.

Read the real domain, not the link text

In an email or on a web page, the blue text you click and the address it leads to can be completely different. Before you click:

• On a computer, hover over the link without clicking and look at the address that pops up in the bottom corner of your browser or email app.
• On a phone, press and hold the link. Most apps show the full address and let you copy it without opening it.

Then find the domain that actually owns the page. Read the address up to the first slash after https:// and focus on the part just before the ending. Using a made-up bank called “mybank”:

Address	Who owns it?
help.mybank.com/login	mybank.com
mybank.com.verify-account.net/login	verify-account.net
mybank-security.com	mybank-security.com, not mybank.com
verify.net/mybank.com	verify.net

The trick in the second row is one of the most common: put a brand name at the very start so that, on a narrow phone screen, it’s the only part you see.

Common tricks in fake addresses

• Lookalike letters: “rn” instead of “m,” a zero instead of an “o,” a lowercase “l” instead of a capital “I.” There are also characters from other alphabets that look almost identical to English letters; browsers sometimes display those addresses starting with xn--.
• Reassuring words: secure, verify, support, account or login tacked onto a brand name.
• The same brand, a different ending: if you always visit a .com site and the link ends in something else, stop.
• An @ sign in the middle: in https://mybank.com@another-site.net, everything before the @ is ignored and your browser goes to another-site.net.
• The padlock as proof: any site can get HTTPS for free. The padlock means nobody can read what you send along the way, not that the site on the other end is who it claims to be.

Shortened links: check them before you open them

Link shorteners are legitimate tools that brands, publishers and creators use every day; if you want the background, here’s what a link shortener is. Their downside is obvious, though: a short link doesn’t tell you where it goes.

That’s why many shorteners offer a way to see the destination first. On linko, you just add a + to the end of the link, for example /offer+. That opens a page showing the destination URL, flags whether the link splits visits between several destinations, and lets you report it if it looks suspicious. If the link is password-protected, the preview says so without revealing the destination.

If the shortener in front of you has no preview and the message feels off, don’t open it. Ask the sender through another channel, or go to the official site yourself by typing the address.

Red flags in the message, not just the link

Phishing works because it plays on emotions. Be suspicious when a message:

• Rushes you: “Your account will be locked in 24 hours.”
• Asks for a small fee to release a package you weren’t expecting.
• Announces a prize, a refund or an invoice you don’t recognize.
• Asks for a code you just received by text. No legitimate company will ask you for it.
• Comes from someone you know, but the tone or the request doesn’t sound like them.

Before you tap, ask yourself four questions: Was I expecting this? Am I being rushed? Are they asking for data or money? Is the domain the usual one? If any answer gives you pause, open the official app or type the website address yourself.

QR codes: the phishing you don’t see coming

A QR code is a link you can’t read with the naked eye. Some scams involve stickers with a fake code placed over the real one on parking meters, restaurant tables or posters, and some emails include a QR code to slip past link filters.

The defense is the same: when you scan, your phone’s camera shows the address before opening it. Read it as carefully as you would in an email. And if scanning a code on the street takes you to a payment page, be wary and pay through the service’s official app instead.

If you share links, make sure they don’t look like phishing

If you run a business or a community, your followers apply these same rules to your links. Make it easy for them to trust you:

• Use aliases people can read, like /holiday-sale, instead of a random string of characters.
• Be consistent: always share from the same short domain and mention it in your bio or on your website.
• Say what’s on the other side: “This link takes you to our shop to see the new collection.”
• Never ask for passwords or bank details through links sent by text or DM.
• On printed materials, write the short link under the QR code so people can check it and type it. There are more ideas in these tips for printing QR codes.

Every destination saved on linko also goes through a check: only http or https addresses are accepted, with no embedded username or password, no internal network addresses, and nothing on the blocked-domain list. Links that break the rules get disabled. If you want short links with your own aliases, you can create a free account.

If you already clicked: what to do now

1. Don’t type anything else. Close the tab and don’t download or open any files from that page.
2. If you entered a password, change it by going to the real site yourself, along with any other account where you reused it. Turn on two-factor authentication.
3. If you shared card or bank details, call your bank at the number on the back of your card or in its official app.
4. If you downloaded something, don’t open it, and scan your device with up-to-date security software.
5. Report it. Flag the message on the platform where you got it, forward scam texts to 7726, and report fraud to the FTC at ReportFraud.ftc.gov.

Frequently asked questions

Is a link with a padlock (HTTPS) safe?

Not necessarily. The padlock means the connection is encrypted, but any site can have one, including fraudulent ones. What really matters is the domain.

Are shortened links dangerous?

Not in themselves; they’re a common, legitimate tool. The risk is that they hide the destination, so use the shortener’s preview or check with the sender before opening one you weren’t expecting.

How can I see where a link goes on my phone without opening it?

Press and hold the link. Most apps show the full address and let you copy it. If it’s a linko short link, add a + at the end to see its destination.

What should I do if someone I know sends me a strange link?

Check with them through another channel, like a phone call, to confirm they really sent it. Hijacked accounts are often used to send scam links to the victim’s contacts.

Is it dangerous to open a phishing link if I don’t type anything?

The risk is much lower than if you enter information or download a file, which is what most of these attacks are after. Even so, keep your browser and operating system updated and close the page right away.