How to Check if a Link Is Safe Before You Click It

Scam messages work by getting you to click. A link in an email, text, social media post or QR code can lead to a fake login page, a fake shop or a download that installs malware. Knowing how to check if a link is safe before you tap it takes about ten seconds and stops most of these attacks. This guide shows the quick checks anyone can do, the tricks scammers use to disguise addresses, and what to do if you have already clicked.

This is an independent guide. We are not affiliated with any bank, shop or tech company mentioned.

Step 1: Preview where the link really goes

The words you see in a message are not necessarily where the link goes. “Track your parcel” or even a full-looking address can point anywhere.

• On a computer: move the mouse pointer over the link without clicking. The real address appears in the bottom corner of the browser or in a small pop-up in your email program.
• On a phone: press and hold the link (do not tap). A preview or menu appears showing the address. Then tap outside it to close without opening.
• In a text message: the address is usually shown in full. Read it carefully before tapping.

Step 2: Read the domain the right way

The domain is the part that tells you who really owns the page. Find it like this:

1. Start after https://.
2. Read up to the first single slash /.
3. In that section, the part just before the ending (like .com, .org, .ca or .gov) is the real owner.

Examples:

Address	Who really owns it
https://www.example-bank.com/login	example-bank.com
https://example-bank.com.account-verify.net/login	account-verify.net (not the bank)
https://login.example-bank.secure-help.co/	secure-help.co (not the bank)
https://www.example-bank.com.evil.example/	evil.example (not the bank)

Scammers put a familiar company name at the start of the address and their own domain at the end, hoping you stop reading early.

Step 3: Watch for common tricks

• Look-alike spelling: an extra letter, a missing letter, swapped letters, rn that looks like m, or a zero instead of the letter O.
• Extra words: company names with “-support”, “-secure”, “-verify”, “-refund” or “-login” added.
• Unusual endings: a well-known brand at an ending it does not normally use.
• Shortened links: services that turn long addresses into short ones hide the destination. Be especially wary in unexpected messages.
• Mismatch with the sender: a message “from your bank” whose link goes to an unrelated site.
• Pressure: “Your account will be closed today”, “Payment failed”, “You have won”. Urgency is a tactic, not a reason to click.

Our full guide to recognising phishing emails covers the other warning signs in the message itself, and QR code scams explains the same checks for codes on posters and parking meters.

Step 4: Use a free link checker

If you are still unsure, copy the link (press and hold, or right-click, and choose Copy link) and paste it into a reputable checker:

• Google Transparency Report, Safe Browsing site status: shows whether Google currently considers the site unsafe.
• Your browser’s built-in protection: Chrome, Edge, Firefox and Safari all warn about known dangerous sites. Keep these protections switched on.

A warning means stop. A clean result is reassuring but not a guarantee, because brand-new scam pages may not be listed yet.

Step 5: The safest habit, go direct

The most reliable way to avoid a bad link is not to use it. If a message says there is a problem with your bank, parcel, subscription or tax account, open the company’s app, or type its address into your browser yourself, and check there. Real problems will be shown in your account.

Links from people you know

A message from a friend, relative or colleague is not automatically safe. Their email or social media account may have been hacked, and scammers often send links to everyone in a stolen contact list with short messages like “Is this you in this video?” or “Look at this”. If a link from someone you know feels out of character, ask them through a different channel, such as a phone call or a fresh text, before opening it. Teaching older relatives this one habit, check with the sender another way, prevents a large share of account takeovers.

The padlock is not a safety badge

The padlock icon in the address bar means the connection is encrypted, so nobody on the network can read what you send. It says nothing about who runs the site. Many phishing and fake shopping sites have a padlock. For shops, also read how to shop online safely and spot fake stores.

If you already clicked the link

Clicking alone rarely infects an up-to-date device, but act depending on what happened next:

• You only opened the page: close it. Clear your browsing history if you like, and do not return to it.
• You entered a password: change it immediately on the real website, starting with your email account, and turn on two-factor authentication. Change it anywhere else you reused it.
• You entered card or bank details: contact your bank straight away, using the number on your card or the bank’s app.
• A file downloaded: do not open it. Delete it and run a scan; see remove malware for free with Windows Security.
• You allowed notifications or installed something: remove it; see stop website notifications.

Report phishing to the organisation being impersonated, and in the US to the FTC at ReportFraud.ftc.gov; in Canada, to the Canadian Anti-Fraud Centre. If you think an account has been taken over, follow how to recover and secure a hacked account.