Here is how to spot a phishing link: ignore the text you see and read the real web address. Find the main domain, the name just before .com, .gov or similar and before the first single /. If it isn’t exactly the company’s real domain, or it’s misspelled, shortened or padded with extra words, don’t open it.
When in doubt, don’t tap. Open the company’s app or type its address yourself. You can also paste a link into our free link safety checker to see where it really goes without opening it.
This explainer is part of our security guides. The same checks work for links in texts, emails, social media messages and QR codes.
Why the link matters more than the message
Phishing is a message that pretends to be from a company or agency you trust so you’ll hand over a password, card number or Social Security number. The FTC says these messages often claim there’s suspicious activity, a payment problem, an unpaid invoice, or a refund waiting for you.
For years, the advice was to look for bad spelling. CISA now warns that AI-written phishing can have perfect grammar, so other signs matter more. The link is the one thing a scammer can’t fully fake: it has to point to a site they control.
How to spot a phishing link in four checks
You don’t need to understand everything in a web address. You only need to find one part of it: the domain.
1. See the real address, not the label
The blue text in an email can say anything. On a computer, hover your mouse over the link without clicking, and the real address usually appears at the bottom of the window. On a phone, a long-press on the link often shows a preview of the address. Exactly how this looks depends on the app.
2. Find the main domain
Read the address from the start, skip the https://, and stop at the first single slash. The part just before that slash is what matters, specifically the last two pieces: the name and the ending.
| Link | Real domain | Safe? |
|---|---|---|
https://www.amazon.com/orders | amazon.com | Matches the real company |
https://amazon.com.account-check.net/login | account-check.net | No. “amazon.com” is just a decoy at the front |
https://www.amazan.com/orders | amazan.com | No. One letter is different |
https://usps-redelivery-help.com | usps-redelivery-help.com | No. Brand name plus extra words |
3. Look for look-alike tricks
- Swapped letters or numbers. CISA’s own example is amazan.com instead of amazon.com. Others swap
lfor1orofor0. - A real brand name in the wrong place.
paypal.secure-login.combelongs tosecure-login.com, not PayPal. - Extra words. Names like
-support,-billing,-verifyor-deliveryadded to a brand. - Odd endings. A bank or agency address that ends in something unusual instead of its normal
.comor.gov. - Link shorteners. CISA lists untrusted shortened links as a phishing sign, because they hide the destination.
- An
@sign or a string of numbers instead of a name. Both can hide where the link really goes.
4. Check the story around it
A perfect-looking link in a message that pressures you is still a reason to stop. Watch for urgency (“within 24 hours”), threats, prizes, or requests for personal or financial details. The FTC’s rule of thumb: legitimate companies don’t ask you to confirm account details through a link in an unexpected message.
The padlock and https only mean the connection is encrypted. Scam sites use them too. A padlock does not mean a site is real.
Phishing link examples by channel
- Texts. Fake delivery problems, unpaid tolls, bank fraud alerts and “wrong number” chats are all common, according to the FTC. Our guide on how to stop spam texts covers filtering them on your phone.
- Email. Fake invoices, account holds and security alerts with a generic greeting such as “Dear customer”.
- Social media and messaging apps. Links from a friend’s account that has been hacked, or from a “support” account.
- QR codes. A QR code is just a link you can’t read. Check the address your camera shows before you open it.
Use a link checker, but don’t rely on it alone
Copying a link (long-press → Copy link on most phones) and pasting it into our link safety checker shows the real destination and flags tricks like look-alike names, shorteners and bare IP addresses. It doesn’t open the link.
No checker can prove a link is safe. Brand-new scam sites may not be on any warning list yet. Treat “no red flags” as “no known warning signs”, and still go to the company directly for anything involving money or passwords.
If you already clicked a phishing link
Clicking alone is usually less serious than what you do next. What matters is whether you typed anything or downloaded anything.
- Close the page. Don’t enter anything else.
- If you typed a password, change it right away on the real site, and anywhere you reused it. Turn on two-factor sign-in. Our guide to setting up passkeys helps stop this in future.
- If you entered card or bank details, call your bank or card company using the number on the back of your card.
- If you entered your Social Security number, go to IdentityTheft.gov, which the FTC recommends for recovery steps based on what was exposed.
- If something downloaded, update your security software and run a scan, as the FTC advises.
How to report phishing links
Reporting helps phone carriers, email providers and investigators block the next wave. The FTC lists these options:
- Texts: forward to 7726 (SPAM), or use your messaging app’s report junk option.
- Emails: forward to reportphishing@apwg.org, and use your email’s report phishing button.
- Any phishing attempt: report it at ReportFraud.ftc.gov. If you lost money online, also report to the FBI at ic3.gov.
Then delete the message. CISA advises not replying and not tapping anything in it, including “unsubscribe”.
Related guide: How to Scan a QR Code on iPhone (and Spot a Fake One First).
FAQ
Can you get hacked just by clicking a phishing link?
Usually the danger comes from what happens next: typing a password or card number, or downloading a file. If you only opened the page, close it, keep your phone and browser updated, and don’t enter anything.
Is a link safe if it starts with https?
No. Https means the connection is encrypted, not that the site is honest. Scam sites use https and padlocks too.
How do I check a link on my phone without opening it?
Long-press the link to preview or copy the address, then read the domain or paste it into a link checker. Don’t tap it to “see what happens”.
What if a link comes from someone I know?
Their account may be hacked. Check with them another way, such as a phone call, before you open it.
Where do I report a phishing link?
Forward texts to 7726, forward emails to reportphishing@apwg.org, and report the attempt at ReportFraud.ftc.gov. Report lost money to the FBI at ic3.gov.
