The fastest way to check a suspicious link

Before you click, hover your mouse over the link without clicking it. At the bottom left of your browser window, you will see the actual web address the link points to. If that address does not match what the link text says, or if it looks wrong in any way, do not click it.

A real PayPal link goes to paypal.com. A scam might say "PayPal" but point to paypa1.com (with a number 1 instead of the letter l) or secure-paypal-verify.com. The text you see is a lie; the address bar tells you the truth.

If you are on a phone and cannot see the address, tap and hold the link instead of clicking. A menu will pop up showing you where it actually goes. Read that address carefully before you tap anything else.

Key Takeaways

  • Always check where a link actually points before clicking it by hovering over it on desktop or tapping and holding on a phone.
  • Scammers use lookalike addresses like amaz0n.com or paypa1.com that look correct at a glance but are slightly different.
  • A link that says it goes to your bank but points to a different web address is a scam, even if the page looks identical to the real one.
  • If a message creates panic or pressure to act right now, that is a red flag — real companies do not threaten you into clicking links.
  • You can also paste a suspicious link into a search engine to see if other people have reported it as a scam.

Watch for lookalike addresses that are slightly wrong

Scammers count on you reading too fast. They register web addresses that look almost identical to the real thing. The number 0 replaces the letter O. The number 1 replaces the letter l. An extra word gets added in the middle. The real domain gets moved to the end after a slash.

Real address: amazon.com Scam address: amaz0n.com (zero instead of O) Real address: apple.com Scam address: apple-security.com (extra word added) Real address: paypal.com Scam address: paypal.secure-verify.com (real name buried in the middle)

When you hover over a link, read the address slowly and carefully. Check the spelling letter by letter. If anything looks off — an extra word, a number where a letter should be, a different ending like .net instead of .com — that is a warning sign.

Red flags in the message itself

The message around the link matters as much as the link itself. Scammers use specific tactics to make you panic and click without thinking. If a message says your account will be closed, your payment failed, or you need to verify your identity right now, slow down and think before clicking.

Real companies do not threaten you into clicking links. Your bank will not send you a text saying "Click here or your account closes." PayPal will not email you saying "Verify now or lose access." These are scare tactics designed to bypass your judgment.

Legitimate companies also do not ask you to click a link to enter passwords, credit card numbers, or Social Security numbers. If a message asks you to click and then log in or provide sensitive information, it is a scam. Real companies direct you to type their web address into your browser yourself.

How to check a link using a search engine

If you are unsure about a link, copy it and paste it into Google or another search engine. Do not click the link itself — just search for the address. If other people have reported it as a scam, you will usually see warnings in the search results.

You can also search for the message text itself. If the message is a known scam, someone else has probably already reported it online and you will find that information quickly.

This method takes thirty seconds and can save you from losing money or having your accounts hacked. It is worth the time whenever you are in doubt.

What to do if you already clicked a suspicious link

If you clicked a link but did not enter any information, you are probably fine. Clicking alone does not infect your device or steal your data. If the page that loaded looked suspicious, just close the tab and move on.

If you entered a password, credit card number, or other sensitive information, act now. Change your password for that account immediately by going directly to the real website (type the address yourself, do not click a link). If you entered a credit card number, call your bank or credit card company directly using the number on the back of your card and tell them what happened. They can watch for fraudulent charges and issue you a new card if needed.

If you entered your Social Security number, you may want to place a fraud alert with the credit bureaus. You can do this for free by calling Equifax, Experian, or TransUnion. A fraud alert makes it harder for someone to open accounts in your name.

Links in emails versus links in text messages

Text message scams are more common than email scams because people check text messages faster and think less carefully about them. A text that says "Your package could not be delivered — click here to reschedule" is almost always a scam. Real delivery companies send you tracking information, not urgent requests to click links.

Email scams use the same tactics but often look more polished because scammers have more space to work with. An email that looks like it came from your bank, with the bank's logo and official language, can still be a scam. The only way to know is to check where the link actually points.

One rule works for both: if you are not expecting the message, or if it creates pressure to act immediately, do not click the link. Instead, go directly to the company's website by typing the address yourself or calling their customer service number from your statement or the back of your card.

Frequently Asked Questions

Can a scam link infect my phone or computer just by clicking it?

Clicking a link alone usually does not infect your device. The danger comes when you land on a fake website and enter your password or credit card information. However, some links can take you to pages that try to install malware, so closing the tab immediately if something looks wrong is the safest move.

What does it mean when a link says it goes to one place but actually goes somewhere else?

That is almost always a scam. Legitimate companies do not hide where their links point. If a link text says "Click here to log into your bank" but the actual address is something completely different, someone is trying to trick you into visiting a fake website that looks like your bank.

Is a link safe if it comes from someone I know?

Not necessarily. Scammers hack into real email and social media accounts and send messages to all the contacts. If a friend sends you a suspicious link, especially one asking you to click and verify something, check with them directly using a phone call or a separate message before clicking. Their account may have been hacked.

What if the website looks exactly like the real company's website?

Scammers copy the real website's design so you will trust it. The only thing that matters is the web address in your browser's address bar. If you are on a fake site, the address will be wrong even if everything else looks correct. Always check the address bar, not the page design.

Can I get in trouble for clicking a scam link?

No. Clicking a link is not illegal and does not make you responsible for anything. If you entered information and money was stolen, that is the scammer's crime, not yours. Report it to the company involved and to the Federal Trade Commission at reportfraud.ftc.gov so they can track the scam.