How to spot a fake link before you click it

Check 1: find the real domain

A web address looks like https://domain/path. Your browser always goes to the domain – the part between https:// and the next slash / – and what decides it is the end of that part (for example paypal.com). Anything in front of it is a subdomain, and whoever owns the domain can call it anything.

Check 2: look for a lookalike name

Fake domains look right at first glance, not at second:

• A swapped or similar letter: rn instead of m, 0 instead of o, l instead of I.
• A different ending: .info, .net or .co instead of the company's real one.
• An extra word: something like paypal-security or bank-verify with any ending. A company that owns paypal.com doesn't need a domain with a hyphen and an extra word.
• Letters from another alphabet: Cyrillic has characters that look exactly like Latin "a", "p" or "o". You can't tell by eye – browsers sometimes show such a domain as xn--…. Our link checker looks for these lookalikes.

Check 3: @ signs, IP addresses and long redirects

• An @ in the address: the browser treats everything before it as a username and goes to the domain after it (the userinfo rule in RFC 3986). https://www.paypal.com@example.com/ goes to example.com.
• A bare IP address instead of a name, such as http://203.0.113.45/login – banks and delivery companies don't send links like that.
• A long jumble with redirect parameters (?url=…, ?redirect=…) – the link may bounce through another server to wherever the scammer wants.

Check 4: shortened links and QR codes hide the destination

A link shortener (bit.ly, tinyurl.com and the like) and a QR code both hide the real address until you open it. Scammers rely on that:

• in December 2023 the US Federal Trade Commission warned that scammers stick their own QR codes over the ones on parking meters, and send QR codes by text and email with a story about a missed parcel, a problem with your account or "suspicious activity",
• according to the FTC, a QR code can lead to a fake login page or install malware that steals information.

What to do: your phone's camera usually shows the address before opening it – read the domain as in check 1. Paste a shortened link, or a photo of the QR code, into our link checker: your browser reads the QR code itself (the image never leaves your device), and when you click we check where the link ends up after every redirect. For tampered parking meter codes and "scan to get paid" tricks, see our guide to QR code scams.

Check 5: the padlock and https prove nothing

The padlock in the address bar only means the connection is encrypted, not that the site is genuine. Anyone can get a free certificate for their own domain, scammers included. Back in June 2019 the FBI's IC3 warned that criminals exploit people's trust in https and the lock icon, and advised not to trust a site just because it has one. The domain decides, not the icon.

Check 6: read the message, not just the link

A fake link almost always comes with a message designed to stop you thinking. The UK's National Cyber Security Centre lists five typical tricks:

• authority – it claims to be from your bank, a government department or another official body,
• urgency – "within 24 hours", "immediately", or you'll face a fine or a blocked account,
• emotion – fear, hope or curiosity,
• scarcity – tickets, money or a prize that's in short supply,
• current events – tax season, holidays, big news stories.

If a message ticks two or more of these and wants you to click, treat it as a scam until you've proved otherwise.

If you're still not sure

1. Don't tap, and don't fill anything in.
2. Copy the link (long-press → Copy link) and paste it into our link checker. You can paste the whole text or email – we pull the links out in your browser, and only the one you choose to check is sent to our server.
3. For an email, our email header analyzer shows where it really came from.
4. Report it: in the UK and the US, forward scam texts to 7726. The NCSC also explains how to report scam emails and websites in the UK. For a suspicious link, the link checker prepares a short report you can copy.

Already clicked?

• You only opened the page: close it and don't fill anything in. Don't open any downloaded file or app – delete it.
• You entered card details, a password or a one-time code: minutes matter – see Entered details on a phishing site: what to do now.
• The link promised more mailbox storage or an account verification: it was after your email password – see “Mailbox full” and “verify your account” scams.
• Someone then calls "from your bank": hang up and call the number on the back of your card, see A fake bank called me.

The most common fake links arrive in parcel delivery scam texts, in fake hotel messages about your booking, in fake Netflix “account on hold” messages and from fake online shops.