A link can say one thing and go somewhere else. Five quick checks show where a link really leads before you tap it.

Step 1: Preview the real address

1. On a computer, rest your mouse on the link without clicking. The real address appears in the bottom corner of your browser or email app.
2. On a phone, press and hold the link. A preview shows the full address. Tap outside the preview to close it.

Step 2: Find the real website name

Look at the part between https:// and the next single slash (/). Read the last two pieces of that section. They name the real website.

• https://www.paypal.com/signin leads to paypal.com. This one is real.
• https://paypal.com.account-verify.net/signin leads to account-verify.net. This one is fake.
• https://www.paypa1.com swaps the letter l for the number 1. This one is fake too.

Step 3: Watch for common tricks

• Misspelled names, like amazan.com in place of amazon.com.
• Extra words added to a real brand, like amazon-account-help.com.
• Shortened links, like bit.ly, which hide the real address.
• A different ending, like .co or .net in place of .com.

Step 4: Do not trust the padlock alone

A padlock icon and “https” mean your connection is encrypted. They do not prove the site is honest. The FBI warns scammers add padlocks to fake sites to win your trust.

Step 5: Run the link through a free checker

1. Press and hold, or right-click, the link. Choose Copy link. Do not open it.
2. Go to Google Safe Browsing site status.
3. Paste the link and search. Google shows whether the site is flagged as unsafe.

A clean result is not a guarantee. New scam sites may not be listed yet.

When in doubt, go direct

Skip the link. Type the company’s address into your browser or open its official app. Read more habits in How to Avoid Dangerous Links.

Sources: Cybersecurity and Infrastructure Security Agency. (n.d.). Recognize and report phishing. Secure Our World.
Federal Bureau of Investigation. (2019, June 10). Cyber actors exploit “secure” websites in phishing campaigns (Alert No. I-061019-PSA). Internet Crime Complaint Center.
Google. (n.d.). Safe Browsing site status. Google Transparency Report.