Check the sender and the context first
Before you look at the link itself, ask where it came from. A link in an email from your bank's official address is different from one in a message from an unknown sender. A link on a website you typed directly into your browser is different from one in a pop-up or a text message.
The safest links come from sources you initiated contact with — you went to the bank's website, you opened an email from a company you do business with, you clicked a link on a page you already trust. Links that arrive unsolicited, especially in text messages or emails from addresses you don't recognize, carry more risk even if they look legitimate.
If someone sent you a link and you're not sure why, ask them about it before clicking. A quick phone call or a separate message asking "Did you really send me this?" takes 30 seconds and can stop you from landing on a fake site designed to steal your password.
Key Takeaways
- Hover over a link (don't click) to see the real web address it points to, which often reveals whether it's fake.
- Legitimate companies rarely ask you to click a link to log in, reset a password, or verify your account — they usually ask you to go to their website directly.
- A link that looks like it goes to one place but actually goes somewhere else is a strong sign of a scam.
- Your browser's address bar shows you the real website you're on after you click; if it doesn't match what you expected, leave immediately.
- When in doubt, ignore the link and go directly to the company's official website by typing the address yourself.
Hover over the link to see where it really goes
On a computer, move your mouse over a link without clicking. A small box or tooltip will appear showing the actual web address the link points to. This is the most direct way to catch a fake link — the real address often reveals the deception.
For example, a link that displays as "Click here to verify your Amazon account" might actually point to "amaz0n-verify-now.com" or some other domain that looks similar but isn't Amazon's real site. The hover preview shows you this mismatch before you click.
On a phone, this is harder because there's no hover. Instead, press and hold the link (don't tap it) and your phone will show you the real address in a menu. On iPhone, this appears as a preview; on Android, it depends on your browser, but most will show you the URL if you long-press.
Watch for the signs of a fake website
Once you click and land on a page, your browser's address bar at the top shows you the real website you're visiting. This is the most reliable information on your screen — it's harder to fake than anything else on the page.
A legitimate bank or email service will have an address like "chase.com" or "mail.google.com", not "chase-verify.com" or "g00gle-mail.net". The difference is small but critical. Scammers count on you not looking closely.
If the address bar shows something unexpected, or if you notice the page looks almost but not quite like the real site (slightly different colors, logos in the wrong place, spelling errors), leave the page immediately. Don't enter any information. Close the tab and go to the official website by typing the address yourself.
Recognize when a company is asking you to do something unusual
Legitimate companies rarely ask you to click a link in an email to log in, reset your password, or verify your account. When they do need you to take action, they usually ask you to go to their website directly — they don't send you a link.
If you receive an email saying "Your account will be closed unless you verify now" with a link, that's a red flag. Real companies give you time to act, and they don't threaten you into clicking. The urgency and the link together are a common scam pattern.
The same goes for unexpected offers. A link in an email saying you've won a prize, been selected for a special offer, or need to claim a refund — especially from a company you don't remember dealing with — is almost always a scam. Legitimate prizes and refunds don't arrive as surprise emails with links.
Use your browser's security features
Modern browsers like Chrome, Firefox, Safari, and Edge have built-in protection against known phishing and malware sites. If you click a link that leads to a site the browser recognizes as dangerous, you'll see a warning page before the site loads. These warnings are usually accurate — take them seriously.
If you see a warning, don't click "proceed anyway" unless you have a very specific reason to believe the warning is wrong. In most cases, if your browser warns you, the site is not safe.
You can also check a suspicious link using a tool like Google Safe Browsing (google.com/safebrowsing) or URLhaus, which let you paste a web address and see whether security researchers have flagged it. These tools are free and don't require you to click the link itself.
What to do if you already clicked a suspicious link
If you clicked a link and landed on a page that asked for your password, credit card number, or other sensitive information, don't panic — but do act. Close the page immediately without entering anything.
If you already entered your password, change it as soon as possible. Go directly to the company's official website (by typing the address yourself, not by clicking another link) and update your password from there. Make it something you've never used before.
If you entered credit card or banking information, contact your bank or credit card company directly using the number on the back of your card or on their official website. Tell them you may have entered your information on a fake site. They can watch your account for suspicious activity and issue you a new card if needed.
Frequently Asked Questions
Can a link look like it goes to one place but actually go somewhere else?
Yes, and this is one of the most common tricks. A link's visible text (what you see) can say anything, but the actual address it points to is what matters. Always hover over the link or check the address bar after clicking to see the real destination.
What if the address bar looks right but the page still seems fake?
Trust the address bar over everything else on the page. If the address bar shows the real website but the page looks wrong, it could be a temporary glitch, a page loading slowly, or your browser displaying cached content. Refresh the page. If it still looks wrong, leave and try again later.
Is it safe to click a link from someone I know?
Usually, but not always. If someone's email account or phone number has been hacked, scammers can send links from that person's contact. If a link from a friend seems out of character or you're not sure why they sent it, ask them about it before clicking.
Do I need special software to check if a link is safe?
No. Your browser's built-in warnings, the address bar, and the hover preview are usually enough. Free tools like Google Safe Browsing can help if you want a second opinion, but they're optional — your browser already does most of the work.
What's the difference between a link that's suspicious and one that's actually dangerous?
A suspicious link is one you're not sure about — maybe it came from an unknown sender or the address looks slightly off. A dangerous link is one your browser warns you about or one that points to a known phishing or malware site. When in doubt, treat it as suspicious and don't click.