How to Tell If a Link Is Safe Before You Click

We all click links every day – in emails, texts, social media posts and messages from friends. Most take us exactly where we expect, but a few are set up to trick us into sharing personal details, downloading something nasty or landing on a fake site.

The good news is you don’t need to be a tech whiz to spot many dodgy links. A quick look can help you decide whether to click or choose a safer path.

Start with the message

Before looking at the link itself, think about the surrounding message.

Were you expecting it? Does the sender’s request make sense? A surprise delivery notice, prize, invoice, or account warning may be legitimate, but unexpected messages deserve a closer look. Be especially cautious if the message creates pressure, such as “Act now or your account will be closed.”

A familiar name or logo isn’t proof that a message is real. Scammers can copy a company’s branding, and sometimes they use an account that belongs to someone you know.

Preview the link first

On a computer, move your pointer over a link without clicking. The destination should appear near the bottom of the browser window. On a phone, press and hold the link to preview its address.

Take a moment to read the address. Does it lead to the company or website you expected? If the link is hidden behind a button or shortened to something like `bit.ly`, it may be harder to tell where it goes. When you can’t confirm the destination, skip the link and visit the website or app directly.

Look closely at the domain

Scam websites often use addresses that look almost like the real thing. They may swap a letter, add an extra word, or use a longer address to disguise the true destination.

For example, in `login.example.com.attacker.test`, the main site is `attacker.test`—not `example.com`. The words at the beginning can look reassuring, but the domain at the end tells you where the address actually leads.

If you’re unsure, don’t guess. Open a browser and type the organization’s known website address yourself, or use its official app.

Remember: HTTPS doesn’t mean “trustworthy”

A website address that starts with `https://` and shows a padlock has an encrypted connection. That helps protect information as it travels between your device and the site.

But a scam site can use HTTPS too. The padlock tells you about the connection; it doesn’t confirm who runs the website. Check the address and the message that brought you there as well.

Be careful with scanners

Link-checking tools can sometimes flag known dangerous websites. They can be useful as one extra check, but they aren’t a guarantee: a new or targeted scam may not have been reported yet.

Also consider privacy. Submitting a private link—such as one from a password reset, shared document, or personal account—to a scanner may reveal that link to the scanning service. If you’re unsure, visiting the organization directly is often the safer option.

If you’ve already clicked

Don’t panic. If the page looks suspicious, close it. Don’t enter personal details, passwords, or verification codes, and don’t download files it offers.

If you entered a password, go to the real website or app and change it there. Turn on multifactor authentication if it’s available. If you shared payment details, contact your bank using the number on your card or its official website.

A simple rule to remember

Pause, preview, and verify. Check who sent the message, look at where the link leads, and take a moment before entering any information. When something doesn’t feel right, open the website or app yourself instead of following the link.

Still worried? Give us a call or send an email now — we're here to help and can get you sorted quickly.