How to Spot a Fake Link Before You Click

A familiar name in a link is not enough to trust it. If an unexpected message asks you to sign in, pay or download, leave the message and open the organisation's official app or an address you already know. You do not have to solve the URL before taking that safer route.

The exercises below explain common address tricks. They are clues for deciding to pause, not a test that can certify a website. Convincing links can be difficult to spot, as the UK National Cyber Security Centre explains.

Read the destination, not just the familiar name

Link text can differ from the address it opens. On a desktop, hovering over a link may show its destination; do not click it to investigate. Compare the complete website address with a trusted, independently obtained address for the organisation. If it is truncated, confusing or different from what you expected, use the official app or known website instead.

Do not use a fixed rule such as "the word before .com" or count a set number of dots. Domain endings vary: auDA recognises .com.au, .net.au and .au direct for Australian businesses, and there are other legitimate endings. Neither a familiar ending nor an unfamiliar one proves whether a request is genuine.

Three fictional address-reading exercises

These are invented, non-clickable examples using the reserved .example ending. They do not identify real organisations or websites. Imagine the organisation's independently verified address is bank.example.

For all three examples, the useful next action is the same: open the known app or independently verified address. Even an exact address match is not a promise that a request or transaction is safe; an existing website or account can be compromised.

What a quick check cannot tell you

• HTTPS is not an endorsement. It encrypts the connection, but does not establish who should be trusted with your money or password. The FTC's shopping guidance makes this distinction.
• A shortened link hides information. It may be used by a legitimate sender or a scammer. Do not open it just to discover where it leads; verify the message through another route.
• Long or unusual text is not a verdict. Genuine tracking links can contain long strings. What matters is whether the request is expected and independently verified.
• No known warning is not proof of safety. New or compromised sites may have little useful history. For signing in, paying or downloading, follow the action-specific website-safety guide.

If you already opened the link

Close it without entering information, opening downloads or approving prompts. If you entered a password or card details, shared a security code, paid, or installed something, take the response steps for that exposure. If you entered card details, contact your bank or card provider promptly even if you did not make a payment. Use a trusted route to contact the relevant account provider; do not wait for a checker result. The damage-control checklist can help you organise what to do next.

Frequently asked questions

Sources and review date

Reviewed 4 September 2026. Sources checked for this revision: auDA's domain guidance and the FTC and NCSC pages linked above; auDA on compromised existing websites; NCSC advice on copying a suspicious link without opening it; and IANA's special-use domain registry for the fictional examples. This guide teaches warning signs, not safety certification.