How to Tell if a Link Is a Scam Before You Click

A link in a text or email can be checked before you tap it. Here is a repeatable way to judge any link.

A link shows up in a text or an email. It looks urgent, and it might be real. You can check it before you tap. Work through the same few questions every time, and you will have your answer.

Where the link came from shapes the risk

Start with the delivery. The FBI says phishing uses emails designed to get your personal details or your financial login. Smishing is the same trick with SMS text messages instead of email. The Postal Inspection Service says smishing scammers often pretend to be a government agency, a bank, or another company to seem legitimate.

So ask who sent it. Did you ask for this message? A tracking text you never ordered, or a bank alert for an account you do not have, is a bad start. The Postal Inspection Service says a text about a USPS delivery, with a strange link, is a scam called smishing.

The channel matters too. A text from a number you do not know carries one kind of risk. An email that seems to come from your own account carries another. If your question is about the message itself, see is this a scam text and is this email a scam.

Read the address: what spoofed URLs look like

The FBI says phishing schemes often use spoofing to lure you in and get you to take the bait. Spoofing means the sender fakes something, and a link is one of the easiest things to fake.

The FBI says scammers use slight differences in email addresses, URLs, and spelling to trick your eye and gain your trust. So read the address closely. A scam link may look almost right, with one letter swapped, an extra word, or a strange ending. The real company name might sit in the middle of the address while the site that loads belongs to someone else.

The FBI also says scammers typically pose as a creditor, a bank, or a state benefits agency.

If the link goes to a full website and you want to judge the site itself, read is this a scam website.

What the page asks for is the real test

A link can look perfect and still be a trap. What it wants from you gives it away.

The Postal Inspection Service says scammers want personal details like usernames, passwords, Social Security numbers, birth dates, and card numbers. It also says legitimate companies will not ask you to confirm or provide personal information. The FBI says companies generally do not contact you to ask for your username or password.

So if a page from an unexpected message asks for a password, card number or Social Security number, treat it as a warning. The FBI says fake websites used in phishing are made solely to steal your information. A page built for that purpose will ask for exactly those things.

The Postal Inspection Service says to verify the sender and ask yourself why the sender wants your information. That question works on every link.

The padlock and https are not a verdict

Many people were told that a padlock means a site is safe. That advice is out of date.

PayPal's security page says the letter s in https does not always mean a site is legitimate, because hackers can build encrypted sites too. It also says many fake sites show a padlock symbol in the address bar, so you should not rely on it.

A padlock means the connection is encrypted. It says nothing about who runs the site. A scammer can get one too.

PayPal's page adds that typos, misspellings, and incorrect grammar are common in phishing messages. Sloppy writing is a useful clue. Clean writing is not proof of anything.

What to do instead of clicking

The FBI says not to click on anything in an unsolicited email or text message. That is the whole rule. You do not need to inspect every link perfectly. You can skip the inspection and go straight to the safe move.

The FBI says to look up a company's phone number on your own and call the company to ask if a request is legitimate. Use the number on your card, your statement, or the official website you find yourself. Never use the number in the message.

If the message claims to be from PayPal, there is one more check. PayPal's page says real PayPal messages always use the full name listed in your PayPal account. A message that says "Dear customer" instead of your name fails that test.

If you already clicked or entered something

Say you tapped the link. Maybe you even typed something in.

The Postal Inspection Service says if you already interacted with the link, even without clicking submit, notify your financial institution. That is the step to take now.

Where to report a scam link

The FBI says to report spoofing and phishing to its Internet Crime Complaint Center at ic3.gov. The Postal Inspection Service says non-USPS smishing complaints can go to that same FBI center, and can also be reported to the Federal Trade Commission.

For a smishing text, the Postal Inspection Service says to forward the message to 7726 to help report the scam phone number.

The FTC says learning the common signs of a scam can help you avoid one. You now know the main ones for links. Check where it came from, read the address, watch what the page asks for, and never trust the padlock. When in doubt, look the company up yourself and call.