How do I check if a link is safe?
Read the domain: the part just before the first single slash, read from right to left. If it isn't exactly the site you expect, don't trust the link. Watch for swapped letters such as rn for m, extra hyphens, and trusted names placed in front of someone else's domain. For anything important, type the address yourself or use a bookmark.
▶ Try it
Why it matters
Lookalike domains swap letters (m and rn), add hyphens, or put a trusted name in front of someone else's domain. What decides who you are talking to is the domain just before the first single slash.
In 7 minutes you'll be able to
- Find the first single slash, then read the domain right to left.
- Swapped letters, extra hyphens and names up front are the classic lookalike tricks.
- For anything important, type the address or use a bookmark instead of a link.
What you'll practise
Read a link like a pro
Four rules for any web address.
- ✂️ Find the first single slash
- Skip the https:// at the start. The owner sits just before the next single /.
- ⬅️ Read right to left
- In login.novabank.com, read com, then novabank. The words to the left are just labels the owner chose.
- 🎭 Names up front mean nothing
- novabank.com.verify-id.io belongs to verify-id.io. Anyone can put a trusted name in front of their own domain.
- 🔒 A padlock isn't a promise
- The padlock means the connection is encrypted. Fake sites have padlocks too.
Who owns this link?
Race the clock. Find the real owner of each address.
https://novabank.com.account-verify.io/login
- account-verify.io (Answer)
- novabank.com
https://login.novabank.com/security
- novabank.com (Answer)
- login.com
https://www.rnapleshop.com/order
- rnapleshop.com, a different site (Answer)
- mapleshop.com
https://novabank-secure.com/verify
- novabank-secure.com, not the bank (Answer)
- novabank.com
https://mapleshop.com/help/novabank.com
- mapleshop.com (Answer)
- novabank.com
Read this text message
A text claims to be from your bank. Tap every red flag.
+44 7700 900123
NovaBank: Your card is blocked. Verify within 2 hours at https://novabank.com-secure-login.app/verify
Reply STOP to opt outSafe habits
You need to log in to your bank. Pick every safe way to get there.
- Type the address yourself
- Use a bookmark you saved earlier
- Open the bank's official app
- Tap the link in the text message
- Click the top sponsored search result
- Trust any page that shows a padlock
Remember
The owner is the domain just before the first single slash. Read it right to left.
For anything important, type the address yourself or use a bookmark instead of a link in a message.
Key facts
- In 2019 the FBI warned that criminals use HTTPS on phishing sites, so the padlock does not prove a site is legitimate. · Source: FBI IC3, Public Service Announcement I-061019-PSA (2019)
- In 2022 the FBI warned that criminals buy search engine ads that impersonate brands and lead to lookalike sites. · Source: FBI IC3, Public Service Announcement I-122122-PSA (2022)
- Letters from other alphabets can look identical to Latin ones, so a domain can look right but be different. Browsers may show such domains in a form starting with xn--.
- Registering a misspelled version of a well-known domain to catch people's typos is called typosquatting.
Updated:
Questions people ask
How can I check a link without clicking it?
Hover over it on a computer, or press and hold it on a phone, to see the real address. Then find the domain just before the first single slash and check it is exactly the site you expect.
Does the padlock mean a website is safe?
No. The padlock means the connection is encrypted, so nobody in between can read it. It doesn't tell you who runs the site, and many phishing sites have one.
What is a lookalike domain?
It is a web address made to resemble a trusted one, for example by swapping letters, adding a hyphen or using another ending. Criminals use them in phishing messages and fake shops.
What should I do if I clicked a suspicious link?
Close the page and don't enter anything. If you typed a password, change it from the real site and turn on MFA. At work, tell IT or security straight away.
Related terms