How to spot a phishing link
Most fake links give themselves away in the address. These seven checks take under a minute and catch the vast majority of them.
Phishing links try to get you onto a page that looks like a company you trust, so you'll type in a password, card number or one-time code. The page itself can be a perfect copy. The address can't, because the scammer doesn't own the real company's domain. That's where to look.
1. Find the real domain
The part that matters is the name just before the first single slash, read from the right. In https://accounts.example-bank.com/login, the real domain is example-bank.com. Everything to the left of it (accounts.) is a subdomain that the owner of example-bank.com chose.
Scammers use this to bury a familiar name on the left: paypal.com.account-review.xyz belongs to whoever owns account-review.xyz, not PayPal.
2. Check the spelling, letter by letter
Look-alike domains swap characters that are easy to miss at a glance:
- A digit for a letter:
paypa1,g00gle,micros0ft - Two letters that look like one:
rnin place ofm,vvin place ofw - Letters from other alphabets that look identical to Latin ones. Browsers sometimes show these as
xn--followed by a jumble of characters.
3. Watch for a brand name on the wrong site
If the link mentions a bank, delivery company or app but the real domain from step 1 isn't that company's, treat it as fake. Words like -secure, -verify or -support bolted onto a brand name are a classic sign.
4. Look for an @ in the address
In a web address, everything before an @ sign is ignored when it comes to choosing the destination. https://www.apple.com@203.0.113.42/ goes to the number after the @, not Apple. Real companies don't build links like this.
5. Be wary of numbers instead of names
A link that points at a raw IP address such as http://198.51.100.7/login skips the domain name entirely. Legitimate businesses almost never send customers to one.
6. Notice the pressure
Phishing messages want you to act before you think. Words like suspended, verify now, final notice, refund or prize, in the message or in the link, should slow you down, not speed you up.
7. Be careful with downloads
A link that ends in .exe, .apk, .scr, .msi or .dmg downloads a program. Invoices, delivery notes and photos never need to be programs. Archives like .zip can hide one inside.
The one habit that beats all seven checks: when a message says there's a problem with an account, don't use its link. Open the company's app or type its address yourself. If something really needs your attention, you'll see it there.
What a padlock does and doesn't mean
The padlock and https:// mean the connection is encrypted. They don't mean the site is honest. Scam sites get free certificates just as easily as anyone else, so a padlock on its own proves very little. A missing padlock on a login page, though, is a red flag.
Not sure about a link?
Paste it into SafeToHop. We read the address without opening it.