What it looks like
Scam links hide behind words you trust. In https://your-bank.secure-login.example/verify, the owner is secure-login.example, and “your-bank” is just a label put in front. Others swap letters (rn for m, 0 for o), add words like “secure” or “verify”, or use a shortened link so you can’t see where it goes.
From: unknown sender
Your account needs checking: https://your-bank.secure-login.example/verify
Why it’s fake: read from the right, the owner is secure-login.example. “your-bank” at the front proves nothing.
Made up for illustration. The sender, company and link don’t exist.
Warning signs
- The owner isn’t who it claimsRead the domain right to left. If the name before the ending isn’t the company’s own, the link isn’t theirs.
- Lookalike spellingSwapped letters (rn for m, 0 for o, a capital I for a small l), extra hyphens, or words like “secure”, “verify” and “login”.
- A shortened linkShort links hide the destination. In an unexpected message, don’t tap one.
- Login or payment straight awayA page that demands your password or card right after an unexpected message. Go to the real site yourself instead.
- Pressure to click quicklyA deadline, a prize, a threat. Urgency is how scammers get you past the checks you’d normally do.
What to do now
- Don’t tap it. On a computer, hover over the link to see the address; on a phone, press and hold to preview it.
- Read the domain from right to left, as above.
- Go to the site yourself: type the address or open the app, and look for the same notice there.
- Still unsure? Ask the sender through a channel you already know, or ask someone you trust.
If you already clicked or paid
- Close the page and don’t enter anything. Just opening a link is usually harmless.
- If you typed a password, change it on the real site now, and anywhere else you used it. Turn on two-step verification.
- If you entered card or bank details, call your bank and ask them to block the card.
- If you downloaded a file or installed something, disconnect from the internet and run a security scan. On a work device, tell your IT team.
How to report it
Report phishing links to your email or mobile provider, and to your local police or national fraud reporting service (in England, Wales and Northern Ireland, Report Fraud at reportfraud.police.uk; in Scotland, Police Scotland on 101). Most browsers also let you report an unsafe site.