A message pops up on your phone: "Your electricity will be cut tonight. Update your bill payment here." There's a link. Your finger is already moving toward it.
Stop right there. Those three seconds matter more than anything else you'll do today online.
Most online scams don't hack your phone in some clever way. They simply get you to open a link and hand over your details yourself. That's why learning to check a URL before opening it is one of the easiest and most powerful safety habits you can build. This guide shows you exactly how, in plain words.
Why Should You Check a URL Before Opening It?
You should check a URL before opening it because fake links can lead to phishing websites that steal passwords, card details, or UPI PINs, or to pages that push harmful app downloads. A quick look at the web address often reveals a misspelled brand name or a strange domain. Checking takes seconds, while recovering from a scam can take months.
Where Dangerous Links Hide
Fake links show up almost everywhere now. SMS messages about deliveries, bills, or KYC updates. Emails that look like they're from your bank. WhatsApp forwards with "exclusive offers." Social media ads. And more and more, QR codes.
QR codes are tricky because you can't read the link just by looking at the black and white squares. The US Federal Trade Commission has warned consumers about scammers hiding harmful links in QR codes, including fake codes stuck on top of real ones on parking meters. Its first tip is simple: inspect the URL before you open it.
How to Read a URL (The One Skill That Matters)
A URL looks confusing, but you only need to find one part: the real domain name.
Take this example: https://www.sbi.co.in.account-verify.com/login
It looks like SBI's website at first glance. It isn't. The real domain is the part just before the first single slash, read from right to left. Here, that's "account-verify.com." Everything before it, including "sbi.co.in," is just decoration the scammer added.
URL | Real domain | Safe? |
Looks genuine | ||
Fake | ||
Fake (rn instead of m) | ||
Fake |
Once you get used to finding the real domain, most fake links become easy to spot.
7 Quick Ways to Check if a Link Is Safe
1. Preview the link first
When your phone camera reads a QR code, it shows the link before opening it. Read it. On iPhone, you can also long-press a link in a message or email to see a preview. On most Android phones, long-pressing a link lets you copy it and look at it first.
2. Look for misspellings and swapped letters
Scammers use tricks like "g00gle" with zeros, "rn" that looks like "m," or an extra letter like "flipkartt." Read slowly. Your eyes naturally auto-correct brand names.
3. Check the ending of the domain
Big brands usually use familiar endings like .com, .in, or .co.in. A bank or government service on an odd ending like .xyz, .top, or .click should make you suspicious.
4. Be careful with short links
Shortened links hide the real destination. They're not always bad, since many businesses use them. But for anything asking you to log in or pay, don't trust a short link from an unknown sender.
5. Don't treat the padlock as proof
Many people think https and a padlock icon mean a site is safe. It only means the connection is encrypted. Scam sites can have https too. So the padlock is necessary, but it's not enough.
6. Use a free link checker
If you're unsure, copy the link and check it with Google Safe Browsing's site status tool. It tells you if Google has flagged the site as unsafe. A clean result doesn't guarantee safety, since new scam sites appear daily, but a warning is a clear sign to stay away.
7. Go to the official source instead
This is the safest trick of all. If a message says your bank account has a problem, don't open the link. Open your bank's official app, or type the website address yourself. If there's really an issue, you'll see it there.
Red Flags That Mean Don't Open the Link
Some messages practically shout "scam." Watch for urgency, like "account blocked in 2 hours." Offers that feel too good, like a free iPhone for filling a form. Requests for OTPs, PINs, or passwords. Messages from unknown numbers pretending to be a company. And any link that asks you to download an app from outside the Play Store or App Store.
If you see even one of these, slow down.
Checking QR Code Links Before Opening
QR codes deserve extra care because they skip the part where you see the link written down.
Before tapping the preview, read the domain the same way you would for any link. Check public codes for stickers placed on top of the original, especially on parking meters, EV chargers, and posters. And never scan QR codes that arrive unexpectedly by email or text, especially ones asking you to act fast.
Want to know more? Read our guide on whether a QR code can be dangerous.
What If You Already Opened a Suspicious Link?
Don't panic. Opening a page usually isn't the end of the world. The real damage happens when you type in details or install something.
Close the page right away. Don't enter any information. If you already typed a password, change it immediately and turn on two-factor login. If you shared card or UPI details, call your bank. Our guide on what happens when you scan a malicious QR code explains the full damage-control steps.
Final Thoughts
You don't need to be a tech expert to stay safe online. You just need to pause and check a URL before opening it. Find the real domain, watch for red flags, and when in doubt, go to the official app or website directly. Share this habit with parents and grandparents too. Three seconds of checking can save a lot of money and stress.