Is This Link Safe? 7 Signs a Link Is a Scam

A link is probably a scam if the name in its address only looks like a real company, it comes from someone you do not know, or it hurries you toward a password, payment or code. The seven signs below cover most of what lands in text messages and email.

The volume is real. The Anti-Phishing Working Group counted 1,069,681 phishing attacks reported to it in the second quarter of 2026, up 10.1% from 971,181 in the first quarter (APWG Phishing Activity Trends Report, published 28 August 2026). That counts sites, not messages, so the number of links sent is far higher.

1. The name is nearly a real one

Scammers register names one letter away from a brand. paypa1-support[.]com swaps the letter l for the number 1. arnazon[.]com uses “rn” in place of “m”. Read the address slowly, letter by letter. Our link checker flags names that copy a known brand.

2. The real company name is in the wrong place

Only the name just before the ending and the first single slash belongs to the site’s owner. In amazon.com.order-help[.]net/login, the owner is order-help.net. Amazon’s name is bait at the front. Another version puts the brand after the slash: random-site[.]xyz/paypal/login. The brand is only a folder name there.

3. It is a short link from a sender you do not know

A short link hides the destination, which is exactly why scammers like it. Courier firms and banks send their own addresses, not free shortener links. See how to see where a short link goes before you tap one.

4. It rushes you

“Your parcel will be returned today.” “Your account will be closed in 24 hours.” “You have won.” A deadline stops you from checking, which is its job. A real company gives you a reference number and a phone number you can look up yourself.

5. It asks for something a real company would not

No bank, tax office or delivery firm needs your full password, a one-time code or your card PIN by link. A small “redelivery fee” or “verification charge” is the usual bait, because a small payment feels harmless and hands over card details.

6. The domain is brand new or looks out of place

A bank that has existed for fifty years does not move to a domain registered last week. It also does not use a free-hosting address such as one ending in a free site builder’s name. Scam sites are often short-lived. In a 2025 study of 286,237 phishing URLs from the APWG feed, the median site lasted 5.46 hours (Lee et al., ACM Web Conference 2025). A link that was fine yesterday can be a scam today, and the reverse.

7. The padlock is the only thing it has going for it

A padlock only means the connection is encrypted. The APWG reported that about 83% of phishing sites used HTTPS in the first quarter of 2021, the latest figure we could verify. Do not let a padlock replace the other six checks.

What to do when you see these signs

1. Do not open the link. Do not reply to the message.
2. Paste the link into a link checker if you want a second opinion. It opens the page on its own browser, not on yours.
3. Open the company’s app, or type its address yourself, to see whether there really is a problem.
4. Delete the message. If it is a text, forward it to your carrier’s spam number where one exists. In the UK that is 7726.
5. If you want the page taken down, report it as phishing.

When a safe-looking link is still a risk

None of the seven signs fire on a link to a hacked genuine site, or one sent from a friend’s account that has been taken over. If a friend sends a link that is out of character for them, ask them through another channel before you open it.

Frequently asked questions