How to Spot a Phishing Link Before You Click

Almost every online scam, from the fake delivery notice to the urgent message pretending to be your bank, depends on one small action: you clicking a link. That link is the doorway, and once you walk through it the scam can ask for your password, plant malware, or take a payment. The reassuring part is that phishing links leave fingerprints, and learning to read them takes minutes rather than training. You do not need to be technical to tell a real link from a trap. You need a short mental checklist and the discipline to run it before you click rather than after, because by the time a bad page has loaded and asked for your details, the hardest part of the attacker's job is already done.

Slow down: urgency is the first red flag

Before you ever examine the link itself, look at the message around it, because phishing almost always arrives wrapped in manufactured urgency. Your account will be closed, a payment failed, a parcel is held, you must act in twenty four hours. This pressure is deliberate. A rushed, frightened person clicks before thinking, which is exactly what the attacker needs. Genuine organisations rarely threaten you into clicking a link within minutes. The moment a message makes your heart rate rise and pushes you to act immediately, treat that feeling itself as the warning. Pause, breathe, and move into checking mode. Almost nothing legitimate is destroyed by waiting five minutes to verify, and almost every scam relies on you not taking them.

Read the real domain, right to left

The single most useful skill is reading where a web address actually points, and the trick is to read the domain from right to left. The true destination is the part just before the first single slash, and specifically the last two labels before that slash. In a made up address like account.yourbank.com.secure-login.ru, the real domain is secure-login.ru, not yourbank. Attackers stuff a trusted name into the early part of the address to reassure you, counting on you reading left to right and stopping at the familiar word. Find the end of the domain, the part right before the first slash, and read the two labels before it. That is where you are really going, no matter what words appear earlier.

Hover or long-press to see the true destination

The text of a link and the place it actually leads can be completely different, which is the whole basis of the trick. A link can say your bank's name in blue underlined text and point somewhere else entirely. On a computer, hover your mouse over a link without clicking and the real address appears at the bottom of the window or in a small popup. On a phone, press and hold the link until a preview of the full address shows, then let go without opening it. Check that the destination that appears matches what the link claims to be. If the visible text says one thing and the revealed address says another, that mismatch alone is reason enough to stop.

Watch for lookalike spelling and sneaky characters

Attackers register domains that look almost right at a glance, swapping or adding characters they hope you will skim past. A zero in place of an o, a letter l standing in for an i, an extra word, or a hyphen inserted into a familiar name. Something like paypa1 with a one, or amaz0n with a zero, or a name followed by a hyphen and a word like secure or verify. These read as correct when you glance but fall apart when you actually look letter by letter. When a link involves anything to do with money or passwords, slow down enough to read the brand name one character at a time. The small misspelling you would normally skip over is often the entire tell.

Be wary of shortened and hidden links

Shortened links, the kind that compress a long address into a few random characters, are convenient and common, but they also hide the real destination completely, which is why scammers like them. You cannot read a domain you cannot see. Treat a shortened link in an unexpected message with extra caution, because the thing you rely on, reading where it goes, has been taken away from you. The same applies to links buried behind buttons or images in an email, where there is no text to read at all. If you cannot see and check the true destination, and the message arrived unexpectedly, the safe assumption is that it is hiding something, and the safe action is not to click it.

When in doubt, go there yourself instead of clicking

The cleanest defence against a suspicious link is to never use it, even if you think it might be real. If a message claims to be from your bank, a shop, or a service you use, do not click the link in the message. Instead, open your browser and type the address you already know, or use the official app you already have installed, and log in the normal way. If there really is a problem with your account, it will be waiting for you there. This habit defeats phishing entirely, because it does not matter how convincing the fake link is when you simply never follow it. Reaching the real site by your own familiar route costs a few extra seconds and removes the attacker's doorway completely.

Know the signs you already clicked something bad

Even careful people slip, so it helps to recognise trouble after a click, because fast action limits the damage. Warning signs include a page that immediately asks you to log in again when you were not expecting to, a site that looks almost right but slightly off, or a sudden demand for information a real service would already have. If you entered a password on a page you now doubt, change that password straight away from the genuine site, and change it anywhere else you reused it. If you entered payment details, contact your bank at once. The worst outcome is pretending it did not happen. Acting within minutes often stops a mistake from becoming a real loss.

Frequently asked questions

How can a link say my bank's name but lead somewhere else? The visible text of a link and its actual destination are separate things. Anyone can write trusted words as the clickable text while the underlying address points anywhere. That is exactly why you hover on a computer or long press on a phone to reveal where the link truly goes before clicking.

Are shortened links always dangerous? No, they are common and often harmless, but they hide the real destination, which removes your main way of checking a link. Treat a shortened link in an unexpected or urgent message with extra caution, and when possible reach the site by typing its address yourself instead.

What should I do if I think I already clicked a phishing link? If you entered a password, change it immediately on the real site and anywhere you reused it. If you entered payment details, contact your bank at once. Acting within minutes is what limits the damage, so deal with it straight away rather than hoping nothing came of it.

A few seconds of checking beats hours of cleanup

Spotting a phishing link is not about technical expertise. It is about a short, repeatable habit: notice the urgency, read the real domain from right to left, reveal where the link actually points, watch for lookalike spelling, distrust hidden links, and when anything feels off, reach the site yourself instead of clicking. Each check takes seconds, and together they close the doorway that nearly every scam depends on. The attackers are betting that you will click first and think later. The whole defence is simply reversing that order, every time, until checking a link before you trust it becomes as automatic as locking your front door.