How to Check a Link Received by SMS or Email

A text says a parcel is waiting. An email asks you to confirm a payment. Before deciding whether the message is genuine, separate two questions: where does its link point, and did you expect this request? An address inspection helps with the first; independent verification is needed for the second.

1. Pause before opening or replying

The FBI’s spoofing and phishing guidance describes how small changes to names and URLs can imitate a trusted sender. If a message pressures you to pay or sign in, open your usual app or trusted bookmark independently. A real-looking logo is not confirmation.

To inspect an address, use your mail or messaging app’s copy-link option without navigating. Interfaces differ: on some phones a long press shows a preview, which may load content. If you cannot copy without opening a preview, skip the inspection and use your normal route to the service.

2. Identify the actual hostname

Consider this fictional example, displayed as plain text:

https://accounts.example.com@signin.example.net/verify

The hostname is signin.example.net. The familiar-looking text before @ is in the user-information portion of the address. It does not make example.com the destination. Likewise, example.com.signin.example.net is not a subdomain of example.com.

Our local link checker uses the browser’s URL parser to display the hostname. Enter a reference such as example.com only if you obtained it independently. A match means the hostname matches that reference or one of its subdomains; it does not verify the organization or the page.

3. Treat signals as questions, not a score

• HTTP: the written address does not request HTTPS. Conversely, HTTPS alone does not establish trust.
• An IP address: ask why the message points to a number instead of the hostname you normally use.
• An internationalized name: an xn-- label represents international characters. Legitimate sites use these too; compare carefully.
• A shortened link: the visible address may conceal another destination. The checker recognizes only some services and does not expand them.
• Encoded characters, backslashes or an unusual port: review how the browser parsed the address, rather than trusting its first visual impression.

An ordinary-looking address can still lead to a malicious or compromised site. No list of visible patterns establishes that a download is clean or that a request is legitimate.

4. Keep private links out of public scanners

A password-reset or invitation link may contain a secret that grants access. Do not publish it in a forum or share it casually. Our checker processes the text in the tab, does not request the destination and does not send the address to analytics. Use Clear when finished. The analysis does not check reputation, DNS, certificates, page content or redirections.

5. Verify the request through a known route

For an unexpected payment, delivery or account warning, inspect your account through the app or bookmark you normally use. The FTC recommends contacting a company through a website or number you know is real, rather than the contact information in the message. At work, use your established reporting channel.

If you entered a password on a suspicious page, contact your verified support team promptly and change the affected password through the genuine service. Review reused credentials and available session-revocation options. If a caller asked you to approve MFA, follow the response checklist in our fake IT support guide.

Your final decision should depend on the independently verified request, not on a reassuring result from a URL tool.