Quick answerTo check if a link is safe, read the domain (the part just before the first single slash) from right to left, look for misspellings or extra words, never trust a link just because it uses HTTPS, and paste it into a link checker such as Drofsecurity's, which tests it against live phishing and malware feeds. If it asks for a password or OTP after you arrive from a message, close it.
Phishing links are the starting point for most account takeovers and payment frauds. They arrive by SMS, WhatsApp, email, social media comments and even sponsored search results. The good news: you can spot most of them yourself with a simple routine.
Read the domain, right to left
The part that matters is the registered domain, the words just before the first single "/". In https://login.hbl.com.secure-verify.top/account the real domain is secure-verify.top, not hbl.com. Scammers put a trusted brand name at the start to fool a quick glance.
Red flags
- Misspellings and swapped letters: paypa1.com, rnicrosoft.com (rn looks like m), jazzcash-pk.help.
- Unusual endings for a bank or government: .top, .xyz, .live, .click, .info.
- Shortened links (bit.ly and similar) in a message about money or accounts.
- A login page you reached from a message rather than by typing the address yourself.
- The page asks for your OTP, PIN or card number to "verify" or "unblock" something.
HTTPS and the padlock don't mean safe
The padlock only means the connection is encrypted. Scammers get free certificates for their fake sites too. Judge the domain, not the padlock.
Check it with a tool
- Long-press the link and choose "Copy link" instead of tapping it.
- Paste it into Drofsecurity's free link checker. It looks for look-alike domains, new registrations and matches in live threat feeds.
- If the result is suspicious or dangerous, delete the message and block the sender.
Already clicked?
Clicking alone is rarely enough to infect a modern, updated phone. The danger is what you type next. If you entered a password, change it now and turn on two-factor authentication. If you entered card or wallet details, call your bank immediately. If something was downloaded, delete it and run a security scan.
Frequently asked questions
Does HTTPS mean a website is safe?
No. HTTPS only means the connection is encrypted. Phishing sites routinely use HTTPS, so always check the domain name itself.
How can I check a link without opening it?
Long-press to copy it, then paste it into a link checker such as Drofsecurity's free checker or Google's Safe Browsing site status page.
What happens if I click a phishing link?
Usually nothing until you enter information. If you typed a password, OTP or card number, change the password or call your bank right away.