How to spot a phishing link
Tools help, but habits protect you everywhere — including places no scanner can reach. Here's what to look for before you click.
1. Check the sender, not just the message
Phishing usually arrives with a story — a parcel held at customs, a locked account, an unpaid invoice. Before reading the story, check who sent it:
- Look at the full sender address, not the display name.
support@paypa1-security.comis not PayPal. - Unexpected contact from a company you do business with? Go to their official site or app yourself instead of following the link.
- Messages from unknown numbers or emails asking you to act fast deserve extra suspicion, not less.
2. Hover (or long-press) before clicking
The visible text of a link can say anything. The real destination is in the URL itself:
- On desktop, hover to preview the destination in the status bar. On mobile, long-press to preview.
- Read the domain — the part between
https://and the next/. That's who you're actually visiting. - When in doubt, paste the URL into the SafeShieldX scanner instead of opening it.
3. Learn to spot lookalike domains
Attackers register domains designed to fool a quick glance:
- Character swaps:
paypa1.com(one instead of L),micros0ft.com(zero instead of O). - Extra words:
apple-support-center.com,secure-bank-login.net— the real brand is not the registrable domain here. - Wrong TLD: your bank on
.xyzor.topinstead of its usual domain. - Subdomain tricks:
paypal.com.evil-site.comis onevil-site.com— everything before the registrable domain is just decoration.
4. Urgency is a tactic, not a coincidence
"Your account will be suspended in 24 hours", "unusual sign-in detected", "claim your refund now" — urgency is engineered to make you click before you think. Legitimate companies rarely demand immediate action through a link in an unsolicited message. Slow down: the emergency is manufactured.
5. HTTPS does not mean trustworthy
The padlock only means your connection to the site is encrypted — it says nothing about who runs the site. Attackers get free certificates too; most phishing pages today use HTTPS. Judge the domain, not the padlock.
6. Treat shorteners and QR codes as sealed envelopes
- Shortened links (
bit.ly/…,t.co/…) hide the destination completely. Expand them with a scanner before opening. - QR codes are worse — you can't even hover. Use the SafeShieldX QR scanner to decode and check the URL before your browser ever touches it.
- Be extra wary of QR codes on flyers, in emails, or stuck over legitimate ones ("quishing").
7. Attachments deserve the same suspicion
Unexpected attachments — invoices, "shipping labels", HTML files asking you to "open in browser" — are a classic malware route. Don't enable macros, don't open HTML attachments that ask for credentials, and verify with the sender through a separate channel.
8. What to do if you already clicked
- Stop. Don't enter any credentials, don't download anything, don't grant permissions.
- Disconnect from the network if you suspect malware (turn on airplane mode).
- If you entered a password, change it immediately from a clean device — and change it anywhere else you reused it.
- Enable two-factor authentication on important accounts (email, banking, social).
- Check bank and card statements for unfamiliar activity over the next few weeks.
- Run a reputable malware scan on your device.
- Report the phishing message to your email provider and, for financial scams, to your bank.
9. Add a layer of protection with a VPN
Spotting bad links is one half of staying safe; protecting your connection is the other. A VPN encrypts your traffic and hides your IP address, which helps on home Wi-Fi and is close to essential on public hotspots — exactly where man-in-the-middle attacks happen. See our recommended VPNs for picks that suit privacy, speed and budget.