A malicious link rarely announces itself — it usually looks like an ordinary shipping notification, a shared document, or a message from a contact whose account was compromised. Most of the useful checks take less time than it takes to click, and they work whether the link arrived by text, email, or a chat app.
Read the Actual Domain, Not Just the Display Text
The text a link shows and the address it actually goes to can be completely different — this is the single most common trick. On desktop, hover over a link without clicking and look at the address that appears (usually in the bottom corner of the browser or email client) rather than trusting the blue underlined text. On mobile, a long-press usually shows a preview of the real destination before you commit to opening it.
Once you can see the real domain, check it carefully:
- Look at what comes right before the first single slash after "https://" — that's the actual domain being visited, regardless of how long or official-looking the rest of the address is. A link like
paypal.com.secure-verify.example.com/loginactually goes toexample.com, not PayPal, no matter how convincing the beginning looks. - Watch for lookalike spellings — a zero instead of the letter O, an extra or missing letter, or a hyphenated variation of a real brand name are all common substitutions designed to be missed at a glance.
- Unfamiliar top-level domains (endings other than the ones a real company would use for their official site) attached to a familiar-looking brand name are a red flag worth a second look.
Unshortening a Shortened Link
Shortened links hide the real destination entirely, which is useful for legitimate sharing but also a common way to disguise a malicious link. Several free link-expander websites let you paste a shortened URL and see the full destination without visiting it — worth using any time a shortened link arrives from an unfamiliar or unexpected source, since there's no other way to know where it leads before clicking.
Using a Free URL Scanner
Beyond manually reading the address, several free tools will scan a URL against databases of known malicious sites before you visit it — pasting a suspicious link into one of these takes a few seconds and checks it against threat intelligence you wouldn't otherwise have access to. This is especially worth doing for a link you're not sure about but feel some pressure to open quickly, since scam messages are frequently designed to create urgency that discourages this exact kind of pause. The FBI's Internet Crime Complaint Center tracks these patterns across reported phishing and scam link campaigns and publishes recurring warnings about the same handful of pressure tactics showing up again and again.
When in Doubt, Don't Click — Navigate Directly Instead
For anything involving an account login, a payment, or personal information, the safest habit is to skip the link entirely and open the service by typing its known address directly into your browser or using its official app, then checking your account from there for whatever the message claimed. If there's a real notification or issue, it will be visible once you're logged in through the address you know is correct — if there's nothing there, the message was fake.
On a Phone, Extra Caution Is Warranted
Small screens make careful domain-reading harder, and text messages don't show sender email addresses the way email does, which is exactly why SMS-based phishing ("smishing") has become so common — the same read-the-domain, don't-click-under-pressure habits apply, just with less room to spot the fake at a glance. This overlaps closely with the habits covered in spotting phishing emails, since the underlying tricks are largely the same regardless of which app the link arrives through.
None of these checks take more than a few seconds once they're habits, and together they catch the overwhelming majority of malicious links before any damage happens — the goal isn't paranoia about every link, just a brief pause and a real look at where it actually leads.