In this article
Phishing messages try to rush you into tapping a link and entering your password, card number or a one-time code on a fake page. They arrive by SMS, email, WhatsApp and social media, and the page often looks exactly like the real one. Learning to read a phishing link takes a minute.
Read the domain, not the page
The part that matters is the domain just before the first single slash. In bank.example.com/login the domain is example.com, not bank. Scammers put a familiar name at the start and their own domain at the end, for example yourbank.secure-login-help.com.
Common tricks
- Swapped letters: rn instead of m, 0 instead of o, or an extra letter.
- Brand name plus a word like login, verify, support, refund or update.
- Link shorteners that hide the real address.
- Urgency: your account will be closed, a parcel is waiting, a fine must be paid today.
Safe habits
- Open your bank or service by typing its address yourself or using its app, never through a link in a message.
- Never share one-time codes. Your bank will not ask for them on the phone.
- Paste suspicious addresses into our website checker before opening them.
- Use a password manager. It will not fill in your password on a look-alike site.
A padlock in the address bar only means the connection is encrypted. Phishing sites have padlocks too.
Frequently asked questions
How can I tell if a link is phishing?
Look at the domain just before the first single slash. If it is not the official domain of the company, do not enter anything.
Does the padlock mean a site is safe?
No. The padlock only means the connection is encrypted. Phishing sites use free certificates too.
