Before you click — set the right mindset
The single most important defense is to slow down. Most phishing attempts work because the target reacts emotionally — fear of a missed payment, excitement about a discount, urgency about an expiring account. If a link makes you feel rushed, that is itself a warning sign. Take 30 seconds to apply the checks below before you click anything.
Step 1: Inspect the full URL, not just the visible text
In rich text emails, chat applications, and even some websites, the visible link text can be completely different from the actual destination. Hover over the link (on desktop) or long-press it (on mobile) to reveal the real URL. Copy it into a plain text editor if needed. The visible 'amazon.com' might actually point to 'amaz0n-security.example.com'.
Step 2: Examine the hostname carefully
- Read the hostname from right to left. The rightmost labels are the registered domain — that is what determines who controls the site.
- Check whether the registered domain matches a brand you trust. 'paypal-security.com' is not PayPal; only 'paypal.com' is.
- Watch for hyphens and extra labels: 'apple.com.secure-login.example' is the example.com domain, not apple.com.
- Look for character substitutions: '0' instead of 'o', 'rn' instead of 'm', 'I' (capital i) instead of 'l'.
Step 3: Watch for punycode and homograph attacks
Internationalized domain names (IDN) can contain Cyrillic, Greek, or other Unicode characters that look identical to Latin letters. A domain that displays as 'аpple.com' may actually contain a Cyrillic 'а' (U+0430), making it a completely different domain from the real 'apple.com'. Modern browsers usually show such domains in their punycode form (xn--...) as a warning, but copy the URL into our URL Security Checker to confirm.
Step 4: Check the scheme and TLS state
HTTPS by itself does not mean a site is trustworthy — anyone can obtain a free certificate from Let's Encrypt for any domain they control, including phishing domains. What HTTPS does guarantee is that the connection is encrypted and that the certificate was issued for the domain you are visiting. The absence of HTTPS on a login or payment page, however, is a strong warning.
Step 5: Inspect query strings and userinfo
A URL like 'https://[email protected]/' actually points to phishing.example — the part before '@' is treated as user credentials, not the hostname. Likewise, very long or obfuscated query strings (especially containing encoded URLs, Base64 strings, or random tokens) often indicate a redirect or tracking chain that may end at a malicious destination.
Step 6: Resolve redirects safely
Many phishing campaigns rely on URL shorteners or redirect chains to hide the final destination. Use a service that previews redirects (such as expandurl.com or our URL Security Checker) rather than clicking through. Be cautious of links from social media that use shorteners — even legitimate ones can be reused for attacks.
Step 7: Verify through official channels
If a link claims to be from a service you use (your bank, an online store, a delivery company), do not use the link to verify it. Open the official app or type the official URL manually. Look up the contact number on the back of your physical card or in a previous statement, not from the email itself.
Step 8: When in doubt, treat as malicious
The cost of ignoring a legitimate email is usually low — the sender will resend or contact you another way. The cost of clicking a malicious link can be account compromise, financial loss, or full device infection. If anything feels off, do nothing until you have verified through an independent channel.