Most scams don't start with hacking. They start with a link: a text about a parcel, an email about a locked account, a message from "your bank". The link leads to a page that looks real and asks for something valuable. The good news is that fake links share a handful of patterns, and once you know them you can check any link in under a minute.
1. Read the real website name, not the whole link
Every web address has one part that matters most: the domain name, the bit just before the first single slash. In https://login.paypal.com/signin the domain is paypal.com. In https://paypal.com.account-verify.help/signin the domain is account-verify.help. Everything to the left of it can be made up by whoever owns that domain.
Scammers rely on people reading from the left and stopping when they see a familiar name. Train yourself to find the end of the address part instead: look for the first / after https://, then read the two words just before it.
| Link | Real website | Genuine? |
|---|---|---|
https://www.amazon.ca/gp/your-account | amazon.ca | Yes |
https://amazon.ca.order-review.info/login | order-review.info | No |
https://canadapost-postescanada.ca/track | canadapost-postescanada.ca | Yes, Canada Post's official site |
https://canadapost-redelivery.com/fee | canadapost-redelivery.com | No |
That last pair shows why this matters. A brand name inside the domain proves nothing: anyone can register canadapost-anything.com. When in doubt, type the company's address yourself or use its official app.
2. Watch for look-alike spelling
Fake domains often swap characters that look alike at a glance:
- The number
1for a lowercasel:paypa1.com - The number
0for the lettero:micr0soft.com rnform:arnazon.comreads as "amazon" on a small screenvvforw, or extra letters:wellsfarg0.com,netfllix.com- International characters that look identical to English letters. These show up in the raw address as
xn--
Look-alikes are hard to catch on a phone. LinkCheckNow flags common ones automatically, but slowing down and reading the domain letter by letter catches most of them too.
3. Be wary of brand-new websites
Scam sites are disposable. They're registered, used for a few days until they're reported and blocked, then replaced. That's why a website's age is one of the most useful facts you can know. A bank, delivery company or government department doesn't send you to a domain that was registered last Tuesday. Our link checker looks up the registration date of the final website and tells you if it's new.
4. Notice where the link came from and how it makes you feel
The technical signs matter, but the message around the link usually gives a scam away first. Be suspicious when a message:
- Creates urgency: "within 24 hours", "final notice", "your account will be closed".
- Asks for a small payment: a redelivery fee, an unpaid toll, a customs charge. The small amount is bait to collect your card number.
- Arrives out of the blue: a parcel you didn't order, a refund you didn't request, a prize you didn't enter.
- Comes from a personal number or odd email address but claims to be a company or government.
- Asks you to log in to "confirm", "verify" or "unlock" something.
A simple rule beats every checklist: if a message asks you to do something with your account or money, don't use its link. Open the company's app or type its website yourself, and look for the issue there.
5. Expand short links and QR codes first
Short links (bit.ly, tinyurl.com, t.co and many more) and QR codes hide the destination completely. That's not automatically bad, since businesses use both all the time, but it removes your chance to read the address before you go. Paste the link into the Link Expander or upload the code to the QR Code Link Checker to see the full path first.
6. Other technical red flags
- A raw IP address instead of a name, such as
http://185.23.10.4/login. Real businesses use names. - An
@sign in the address. Everything before the@is ignored by the browser, which makes it a classic disguise. - Lots of redirects through unrelated sites before landing somewhere.
- A link that downloads a file (.exe, .apk, .zip) when you expected a web page.
- No padlock / plain http on a page that asks for a password. Note that the padlock only means the connection is encrypted. Scam sites have padlocks too.
A 30-second routine for any link
- Don't tap yet. On a phone, press and hold the link and choose Copy.
- Paste it into LinkCheckNow to see the full path and the final website.
- Read the final domain name carefully. Is it the company's real, familiar address?
- Check the age and any warnings in the result.
- If anything feels off, or the message is about your account or money, go to the company directly instead.
Reporting fake links
Reporting helps take scam sites down faster. In Canada, forward scam texts to 7726 (it spells SPAM on the keypad) so your carrier can block similar messages, and report fraud to the Canadian Anti-Fraud Centre through reportcyberandfraud.canada.ca. In the United States, forward texts to 7726 and report scams to the FTC at ReportFraud.ftc.gov. Email apps also have a built-in "Report phishing" button.
Frequently asked questions
Can I get hacked just by clicking a link?
It's rare on an up-to-date phone or computer, but possible through unpatched security bugs or by downloading a file the page offers. The far bigger risk is what happens next: a fake page asks for your password, card details or a "small fee", and you type them in. Keeping your device updated and never entering details on a page you reached from a message protects you from most of it.
What should I do if I already clicked a suspicious link?
Close the page. If you didn't enter anything or download anything, you're very likely fine. If you entered a password, change it right away on the real site (and anywhere else you use it) and turn on two-step verification. If you entered card or banking details, call your bank using the number on the back of your card. Then report the message.
Are short links always suspicious?
No. Businesses use short links every day because they're tidy and trackable. A short link just hides the destination, so expand it first with a link expander and judge the final address.
Where do I report a scam link?
In Canada, forward scam texts to 7726 (SPAM) and report fraud to the Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca. In the U.S., forward texts to 7726 and report to the FTC at ReportFraud.ftc.gov. You can also use the "Report phishing" or "Report junk" option in your email app.