How to check a suspicious link without opening it

Check the request before checking the address

Start with the action the message wants: a login, payment, download, identity document or immediate reply. You do not need to identify the sender or prove a crime before deciding to pause. An unexpected request deserves an independent check even when its wording is polished and its logo looks familiar.

Write a short description for yourself: who supposedly sent this, what they want, and when they say it must happen. This separates the claim from the pressure surrounding it. A message about an account problem and a message advertising an offer require different checks; neither requires you to explore the supplied link.

Use a separate route to the organisation

The US Federal Trade Commission recommends contacting the organisation through a website or number you already know, rather than the details in a suspicious message. Open the organisation's installed app or an existing trusted bookmark. Look for the claimed order, notification or request there. If needed, use the contact information in that app or a previous genuine statement.

Hypothetical example: a message says a parcel needs an address correction. Open the delivery service through your original order record and check that order's status. A parcel number printed in the message is a clue to compare, not independent confirmation. If the message claims to come from a friend, ask through a separate established contact whether they actually sent it.

What can the visible link tell you?

A mismatch between the claimed organisation and the visible website address is a reason to stop. The FBI warns that phishing sites can use HTTPS: encryption of the connection does not establish that the business or message is trustworthy. A brand name somewhere in a long address is also insufficient to establish ownership.

Inspect only what your device already displays. Do not tap a link to reveal the destination, or experiment with a preview if you are unsure whether it will load the page. A shortened or partly hidden address leaves you with less information. You can still verify the underlying request independently; expanding or visiting it is unnecessary.

Treat warning signs as reasons to verify

Avoid a scoring game in which three convincing details cancel out one serious concern. A correct logo does not answer why an unexpected sender needs your credentials. Good spelling does not answer why the request cannot be completed through the normal app. A familiar event does not establish that this particular message came from its organiser.

Make your checks specific. For a supposed event invitation, find the organiser's announcement. For an account alert, check account activity through the existing app. For a supposed public benefit, find the responsible agency's published information. If those checks do not resolve the request, keep it unverified and leave the link alone.

A link checker is another signal, not permission to click

Google's Safe Browsing guidance explicitly acknowledges both missed threats and mistaken warnings. A result saying no threat was found does not authenticate a sender, confirm an offer or prove a site will remain safe. Do not override your independent checks because a tool gives a reassuring result.

ForwardCheck's published method describes checking links against Google Web Risk and warns that an unlisted link can still be a scam. That is a useful distinction to retain when reading any report: checking known technical risks and checking whether a message's claim is true are separate questions.

Avoid posting private account links or messages containing personal information in public groups for other people to investigate. Describe the request without repeating the live link. People helping you need to understand the concern, not receive another opportunity to open it.

If you have already opened it

Stop interacting with the page. Record what happened: whether you only visited, entered information, installed something or made a payment. Those are different situations. Seek help through the affected service's genuine support channel and explain the specific action taken. Do not use a recovery contact supplied by the suspicious page.

Hypothetical group reply: I have not confirmed this request with the organisation. Please use your usual app to check your account before acting. This communicates what is known without declaring a site safe or making an accusation you cannot support.

Common questions

Does HTTPS mean a link is safe?

No. HTTPS concerns the encrypted connection. A phishing site can also use it; it does not establish that a request or organisation is genuine.

Can I check the message without opening its link?

Yes. Use the organisation's existing app, a trusted bookmark or a known contact to verify the underlying request. You do not need to visit the supplied address.

What if a link checker finds no threat?

Keep checking the request independently. No threat found is not a guarantee of safety or confirmation that the sender is authentic.