How to Check a Suspicious Link Without Opening It

6 min read ScamSense Team Updated October 23, 2026

You don’t need to open a link to learn a lot about it. The address itself, the way it reached you, and a few free lookups can tell you whether it deserves a tap. This guide shows how to inspect a link safely, how to read an address, and — honestly — what these checks can and can’t prove.

Quick answer: Press and hold the link (or hover on a computer) to read the full address without opening it. Find the real domain — the part just before the first single slash and the ending such as .com — and ask whether it belongs to the organisation named in the message. If you weren’t expecting the message, or the domain doesn’t match, don’t open it: go to the organisation’s site yourself. No check can prove a link is safe.

If the link has already been opened, see Been Scammed? What to Do in the First Hour or the phishing section of How to Spot Phishing Emails. For the general habit of pausing, read the 10-second rule.

Step 1: Look at the Message Before the Link

Were you expecting it? A delivery link when you haven’t ordered anything, or a “bank” link when you’re not a customer, is suspicious already.
Does it create urgency, threaten you, or promise money? See How Scammers Create Urgency.
Did it arrive through the channel that organisation normally uses?

Step 2: Preview the Address Without Opening It

On a phone, press and hold the link until a menu or preview appears and read the address, or choose Copy link and paste it into a notes app to read it. Don’t tap through.
On a computer, hover the pointer over the link and read the address in the corner of the window. In email, check that the visible text and the destination match.
For a QR code, use a scanner that shows the address before it opens and read it the same way. A QR code on a sticker, letter or parking sign can be placed by a stranger.
For a shortened link (bit.ly-style), the real destination is hidden. Some shorteners show a preview if you add a plus sign or use their preview option; otherwise be cautious, especially if the message is unexpected.

Step 3: Read the Domain Correctly

The part of the address that decides who controls it is the registered domain: the name immediately before the ending (.com, .co.uk, .in and so on), reading from the right until the first single slash. Everything to the left is just a label the owner chooses.

Address (illustrative)	Whose domain it really is
https://secure.mybank.com/login	mybank.com — matches the bank
https://mybank.com.secure-verify.help/login	secure-verify.help — the bank name is only a prefix
https://mybank-support.net/login	mybank-support.net — a different domain with the brand in its name
https://rnybank.com	rnybank.com — “rn” looks like “m”

Watch for: extra words (secure, verify, support, refund), hyphens, swapped letters, a different ending from the one you expect, numbers instead of letters, and an @ sign or a long string of digits where a name should be. Padlock icons and https only show the connection is encrypted, and scam sites have them too.

Step 4: Use Free Lookups, With Limits

Domain registration age: lookup.icann.org shows when a domain was registered. A brand-new domain claiming to be a long-established organisation is a reason for doubt, though new domains aren’t always bad.
Safe-browsing status: Google’s Safe Browsing site status tool (transparencyreport.google.com/safe-browsing/search) shows whether Google currently flags a site. VirusTotal (virustotal.com) can scan an address against many security engines.
Limits: New phishing sites often aren’t flagged for hours or days, so a clean result is not proof of safety. Pasting a link into a public scanner may also make it visible to others, so don’t submit addresses that contain personal tokens, such as password-reset or private-document links.

Step 5: Decide What to Do

If you weren’t expecting it, or the domain doesn’t match, don’t open it. Go to the organisation yourself by typing its address, using its official app or searching for it, and check for the same notice there.
If it came from a person you know, ask them through another channel whether they sent it; accounts get hacked and forward malicious links.
If it asks for a login, payment, code or app install, stop. Don’t enter anything on a page you reached from a message. Real organisations can be reached directly.
If you must look at an unknown page, use a device and browser with no saved logins and don’t download or enter details. This reduces but doesn’t remove risk.
Report it. Forward phishing texts and emails to the organisation being impersonated, and report them to your national fraud service or your phone carrier’s spam-reporting service.

Illustrative scenario — fictional, names and details are invented

Leila receives an SMS: “Your parcel is held. Confirm delivery and pay the $1.99 fee: post-office-track.help/lm7.” She is expecting a parcel, so it seems plausible.

She long-presses the link to read the address: the real domain is post-office-track.help, not her national post office’s site. She doesn’t open it. She types the postal service’s own address into her browser, enters her tracking number there and sees the parcel is on its way with no fee due. She deletes the text.

What mattered: she compared the real domain with the real organisation, then went to the organisation herself.

What About a Checker App?

Automated tools can speed up the first look. ScamSense, for example, lets Android users paste a link, message or screenshot and get a risk assessment with explanations of the warning signs. It’s a second opinion: it can’t guarantee that any link is safe, and a link that looks fine can still be dangerous. Use it alongside the steps above, and never as a reason to skip going to the organisation directly.

If You Already Opened the Link

Close the page without entering anything. If you typed a password, change it from a trusted device (see Account Hacked? What to Do).
If you entered card details or a one-time code, call your bank on an official number and read what to do after sharing an OTP.
If a file downloaded or an app was installed, see What to Do If You Installed a Suspicious App.

Key Takeaways

Preview the address without opening it, then read the registered domain, not the whole string.
Free lookups help, but a clean result doesn’t prove a link is safe.
When in doubt, go to the organisation yourself rather than through the link.
Never enter logins, payments or codes on a page reached from an unexpected message.

Want a second opinion on a link or message?

Paste the link, message or a screenshot into ScamSense on Android for a risk assessment with the warning signs explained. It is a second opinion, not a guarantee that a link is safe.

Start 3-Day Free Trial

Frequently Asked Questions

How can I see where a link goes without clicking it?

On a phone, press and hold the link and read the address or copy it to read it; on a computer, hover over it. For QR codes, use a scanner that shows the address before opening.

How do I find the real domain in a web address?

Look at the part just before the ending (such as .com) and before the first single slash. Everything to its left is a label chosen by the domain owner, so mybank.com.example.help belongs to example.help.

Does the padlock or https mean a site is safe?

No. It only means the connection is encrypted. Scam sites can have it too.

If a scanner says a link is clean, is it safe?

Not necessarily. New malicious sites often aren’t flagged yet. Treat a clean result as one signal, not proof.

Should I paste links into public scanning sites?

Be careful. Public scanners can make the address visible to others, so don’t submit private links such as password resets or personal document shares.

Can ScamSense tell me whether a link is safe?

ScamSense on Android can assess a pasted link or message and explain warning signs, but it cannot guarantee any link is safe. Use it alongside the checks in this guide.

Note: This guide is general information, not legal or financial advice. Procedures, deadlines and refund rights differ by country, bank and payment method. Always use contact details from your bank’s official app, website or the back of your card. ScamSense helps you assess suspicious content but cannot guarantee that any message, link or caller is safe or unsafe.