To check a suspicious link without opening it, inspect the actual address, compare its domain with the organization’s known website, and verify the request through an official app or trusted contact. A link checker can provide additional information, but a reassuring result does not prove that the destination is safe.
The safest immediate step is to leave the link alone and access the service independently. If a message says your bank account needs attention, open your banking app. If it mentions a delivery, check your order through the retailer or carrier you already use.
You do not need to visit an unfamiliar website to decide that a different route is safer.
1. Reveal the actual link address
The words you see in a message are not necessarily the address behind them. A button labeled “Track your package” or text displaying a familiar website can point somewhere else.
On a computer
Move your pointer over the link without clicking. Many browsers and email applications display its destination near the bottom of the window or in a small tooltip.
Read the address carefully. If it disappears too quickly or is cut off, you may be able to right-click and choose Copy link address or Copy hyperlink. Paste it into a local plain-text editor for inspection.
Avoid pasting it into your browser’s address bar, where an accidental Enter could open it. Copying the destination address is also different from copying the visible words.
The Competition Bureau of Canada recommends hovering over links to inspect their addresses before clicking.
On a phone or tablet
Mobile apps handle links differently. Some offer a copy-link option; others show a webpage preview when you press and hold.
Do not assume a preview avoids contacting the website. A preview may retrieve content from the destination.
If you cannot confidently copy the address without opening it or triggering a preview, skip this step. Open the organization’s official app or contact the sender through a separate, trusted channel instead.
2. Find the domain before reading the rest
A URL is a web address. Its domain helps identify the website being requested; the text after the domain usually identifies a page or passes additional information.
Consider this fictional, deliberately non-clickable example:
https://accounts.example[.]com/billing?notice=123
Here:
https://describes the connection method.accounts.example[.]comis the hostname.example[.]comis the main domain in this example./billingis the page path.?notice=123passes information to the website.
Words such as “billing,” “secure,” and “verification” in the path do not establish who operates the website. MDN’s explanation of URL structure distinguishes the domain, path, and parameters.
Watch for familiar names in the wrong place
Suppose a fictional company called Maple Bank uses maplebank[.]example.
Compare these illustrative addresses:
Address | What it shows |
|---|---|
| A subdomain of |
| A subdomain of |
| A page on |
Swipe to view the full table
The second and third addresses contain the bank’s name, but that does not make them the bank’s website.
These examples explain address structure; none establishes that a destination is safe. Real domain endings can also contain multiple parts, such as .co.uk, so “take the last two words” is not a universal rule.
If you cannot confidently identify the domain, use an independent route.
3. Look for misleading spelling and context
Compare the domain with an address you already know is genuine, such as one saved in a trusted bookmark or printed on an account statement.
Look for:
Missing, added, or rearranged letters.
Numbers substituted for letters.
Extra words attached to a familiar brand name.
A different domain ending.
An unfamiliar address for an unexpected login or payment request.
Mozilla documents phishing addresses that imitate legitimate domains by replacing characters with similar-looking ones.
A mismatch deserves attention, but it does not automatically establish fraud. Organizations sometimes use external services for communications and payments. The appropriate response is independent verification.
Also consider what the message asks you to do. Does a marketplace buyer want you to leave the platform to “receive payment”? Does a supposed colleague unexpectedly ask you to sign in to view a document?
A plausible address cannot establish that the surrounding request is legitimate. Phishing messages can even include personal details to make an impersonation more convincing.
4. Do not treat HTTPS as proof of legitimacy
An address beginning with https:// indicates an encrypted connection when correctly established. It does not prove that the website belongs to the organization named in the message.
A fraudulent website can use HTTPS too.
Google explains that a secure connection keeps information private between you and the site, while still advising users to verify the site’s name before sharing sensitive information.
You do not need to open the suspicious destination to look for a padlock. The letters “https” alone cannot answer whether you should trust the request.
5. Treat shortened and redirected links as unresolved
Shortened links hide the destination behind a compact address. Businesses and individuals use them legitimately, but the visible short address gives you less information about where you would end up.
A longer link can also redirect through another website before reaching its destination.
If your goal is to avoid contacting the destination, do not open the link to see where it goes. Be cautious with link expanders too: depending on how they work, they may contact the URL on your behalf.
For an unexpected account alert, invoice, or payment request, you usually do not need to resolve the redirect at all. Open the relevant service independently and check there.
An opaque link is a reason to choose another verification route. Its length alone does not prove that it is malicious.
6. Use a suspicious URL checker with clear limits
A suspicious URL checker or phishing link checker can add useful evidence. Depending on the service, it may consult reputation databases, compare security vendors’ findings, or analyze other warning signs.
Before submitting anything, check what the service does with URLs and whether submissions or reports are shared.
For example, VirusTotal documents that its scanning reports are shared with its public community and that information is shared with examining partners. Do not assume that a public checking service is a private workspace.
Keep private links out of public tools
Avoid submitting URLs containing:
Password-reset or sign-in tokens.
Private document invitations.
Account-access links.
Financial or medical information.
Unnecessary personal details.
Some links grant access simply because the recipient possesses them. If you cannot tell whether an address contains private access information, do not submit it to a public service.
Checking only a domain may reduce what you disclose, but it does not assess the complete link. Removing parts of an address changes what you are checking.
Interpret the result cautiously
“No threats detected” means the tool did not identify a threat within its checks. It is not a safety certificate.
Likewise, a warning is a reason to stop and investigate; automated systems can flag legitimate content. VirusTotal explicitly discusses these false positives in its documentation.
If tools disagree or the result is unclear, keep the link unopened and verify the request independently.
Where SamFindr can help
SamFindr uses AI to help analyze suspicious messages and links for warning signs.
Before submitting content, remove passwords, authentication codes, full financial details, and unnecessary personal information. Do not submit private access links.
Received a link you cannot explain? Use SamFindr to help identify warning signs. Treat the assessment as additional guidance: AI can miss threats or flag legitimate content.
7. Verify the request independently
Inspecting an address helps you decide what to question. Independent verification helps you determine whether the requested action is real.
Choose the route that fits the message:
Message claims | Safer verification route |
|---|---|
Your bank account needs attention | Open your banking app or call the number on your card |
A delivery needs payment or an address correction | Check the order through the retailer or carrier’s known website |
A marketplace payment is waiting | Review the transaction inside the marketplace app |
A colleague shared an unexpected document | Confirm through a known phone number or established workplace channel |
Swipe to view the full table
Use a trusted bookmark, a known address, or an app already installed from a legitimate source. Do not use the phone number or contact details supplied in the suspicious message.
The Federal Trade Commission recommends contacting an organization through a website or phone number you know is genuine.
If the request cannot be confirmed, leave the link alone. You do not have to prove that a destination is malicious before deciding not to use it.
A fictional delivery-link example
Imagine receiving this text:
Your package is on hold. Pay $1.95 within two hours to avoid return.
https://delivery.example[.]com/confirm
This is a fictional illustration, not a reported incident.
The address belongs under example[.]com; the word “delivery” does not identify a carrier. The unexpected fee and deadline also give you reasons to question the request.
Those observations do not establish what the destination contains. They establish that you should verify the claim elsewhere.
Open your retailer account, locate the actual order, and check tracking through the known carrier. If the request remains unclear, contact support through verified details.
What if you already opened the link?
Stop interacting with the page. The next steps depend on what happened.
If you only opened it
Close the page, do not approve prompts or open downloads, and check whether you granted permissions or downloaded anything. A click alone does not establish that an account was compromised.
If you entered a password or authentication code
Use the genuine service to change the affected password, review account security, and contact support. Change reused passwords elsewhere and enable multi-factor authentication.
Get Cyber Safe recommends changing affected passwords and strengthening account protection after phishing.
If you downloaded or installed something
Do not open downloaded files. If harmful software may have been installed, update your security software and run a scan.
For a work device, contact your IT team.
If you shared financial information or sent money
Contact your bank or payment provider promptly through verified details. Preserve the message and transaction records. Recovery is not guaranteed.
The Canadian Anti-Fraud Centre provides guidance for fraud victims, including contacting financial institutions and keeping evidence.
In Canada, follow the Canadian Anti-Fraud Centre’s reporting instructions. In the United States, report phishing through ReportFraud.ftc.gov.
