Inspect a link before you click: quick checks that stop scams

You open an email that says your bank account is frozen and includes a link. The login page looks exactly like the bank’s site — but clicking can hand your password to a criminal or trigger a malware download. That exact scenario is how many people get compromised. Below are the immediate, practical checks to do first so you can decide whether a link is safe without guessing.

Quick checks to do first

• Hover (desktop) or long‑press (mobile) — On a computer, move the mouse over the link without clicking and read the address that appears in the browser’s status bar or tooltip. On a phone, touch and hold the link to preview the full URL. If the preview doesn’t match the site you expect, don’t click.
• Read the scheme and the registered domain — Confirm the URL starts with “https://” (encrypted transport) and then read the registered domain (for example, in https://accounts.example.com/login the registered domain is example.com). If the brand name appears only as a subdomain (login.bank.example.com) the real owner is example.com, not the bank.
• Watch for obvious tricks — Misspellings (paypa1), extra words, unexpected top-level domains (.net instead of .com), long random strings, or brand names only in the path (example.com/PayPal-login) are red flags.
• Check the padlock — but don’t assume safety — A padlock means the connection is encrypted, not that the site is legitimate. Malicious sites can and do use HTTPS.

If something looks off: non‑click checks to run next

1. Copy and paste the link as plain text — Paste the URL into a text editor or the browser address bar (don’t press Enter). Seeing the full text removes any hiding the link label might do. Watch for percent‑encoded characters (%2F, %2E) that can obscure real paths.
2. Expand shortened URLs safely — Short links hide the destination. Use a URL preview or a reputable URL expander to see the final domain and any intermediate redirects rather than clicking the short link.
3. Scan the URL with a reputation service — Paste the link into a reputable URL‑scanning or reputation service to check for known malware or phishing reports. This checks community warnings without exposing your device.
4. Search the domain itself — Enter the domain (not the whole URL) into a search engine with terms like “scam,” “phishing,” or “reviews.” People often report fraudulent domains quickly.
5. View certificate details cautiously — Click the padlock to inspect certificate information. Browsers differ in what they show; lack of obvious problems in the certificate doesn’t guarantee the site is legitimate, and organization names may not appear for all certificates.

How attackers hide in domains (and how to spot it)

• Subdomain tricks — scamsite.com vs paypal.scamsite.com. If the brand name is not immediately before the top‑level domain, it’s probably not the official site. Example: paypal.secure-login.com is not PayPal.
• Lookalike characters and punycode — Attackers swap similar characters (paypaƖ, paypa1) or use international letters. If a domain includes “xn--” it’s using punycode to represent non‑ASCII characters—double‑check visually and compare to the known site.
• Extra words, dashes, or long names — Domains like secure-paypal-account.com try to look legitimate. Real companies usually use short, clear domains and direct subdomains for services.
• Redirects and query strings — Long query strings or parameters named “redirect” or “url” can send you somewhere else after an initial page. Be cautious when you see them.

Decide what to do and final safety precautions

• Avoid the link entirely — If the domain is unfamiliar, contains brand names in the wrong place, has obvious misspellings, or a reputation scan flags it, do not click.
• Safer alternatives — Type the organization’s known address manually, use a saved bookmark, or open the official app. For account issues, contact the company through phone or the support area on their verified site rather than following an emailed link.
• If you must visit a suspicious link — Prefer not to. If there’s no other option, use a device you can control (disable autofill, use a browser profile without saved passwords, and do not enter credentials). Opening a link in a private/incognito window reduces some local traces but does not stop malware or protect against credential theft.
• Report and remove — Report phishing emails to your email provider and the real service the message claims to be from, then delete the message. For SMS, report to your carrier where possible.
• If you clicked and entered credentials — From a trusted device, go directly to the real site (not via the link) and change your password, enable two‑factor authentication, and review account activity. Notify the service and your bank if financial information may be exposed. Consider running an antivirus scan on the device and use unique passwords or a password manager going forward.

Stopping a scam usually comes down to a few careful checks: peek at the real URL, expand short links, scan unknown links, and when in doubt navigate to the site manually. These steps lower the chance that a convincing fake will lead to a real compromise.