How to check a link before you click it

Why it's hard to tell

On a small phone screen, a web address is easy to miss. Scammers choose addresses that look right at a glance, with a letter swapped or an extra word added.

The FTC describes the usual shape of a phishing message. It arrives from a company you appear to know, says there is an account problem or suspicious activity, and asks you to confirm details or make a payment. The page behind the link is built to copy the real one, so anything typed there goes to the sender.

Common tricks used

• A delivery, toll, bank or refund notice that arrives without you asking for it.
• A link that asks you to pay or to update your payment details. The FTC notes that legitimate companies do not email or text links to update payment information.
• A web address that nearly matches the real one, with a swapped letter or a different ending. The FBI warns about lookalike domains and says an official government website should end in .gov.
• A QR code that leads to a link you cannot see until you scan it. The FTC advises checking the address your QR reader shows, looking for misspellings or switched letters, before opening anything.

How to verify, step by step

1. Ask the first question the FTC suggests: do I have an account with this company, or do I know this person? If the answer is no, do not click or open attachments.
2. If the answer is yes, leave the message. Open the company's app, or type the website address yourself, and look for the same notice there. A real account problem will show up inside your account.
3. Alternatively, ring the company on a number you know is real, such as the one on a card or statement. Do not use the contact details in the message.
4. If you do look at an address, read it slowly. Misspellings, switched letters and an ending that does not match the organisation, such as .com for a government agency, are reasons to stop.
5. Do not reply to the text, even to say stop. A reply confirms that your number is active.
6. Report the message and delete it. For a text, forward it to 7726 (SPAM) or use the report junk option in your messaging app. In the UK, the NCSC takes scam emails at report@phishing.gov.uk, and the same 7726 number works for texts. In the US, you can also report at ReportFraud.ftc.gov. Our guides to reporting a scam in the US and in the UK explain the options.

If you already clicked

• If you only opened the page and typed nothing, close it and run a scan with your security software. The FTC suggests updating the software and removing anything it flags.
• If you entered a password, change it at once, and change it anywhere else you used the same one.
• If you shared a card, account or Social Security number, the FTC points to IdentityTheft.gov for steps matched to what you shared.
• If someone then phoned you, hang up and read what to do after you shared a code or gave someone access.

Things to watch

• Messages from companies you have never dealt with.
• Notices that ask for a code, a password or a payment through a link.
• A sender who texts again from another number after you ignore the first message.

If a text pretends to come from a delivery firm, our article on the package delivery text shows how that version looks.