What Is a Phishing Link? How to Check a Suspicious Link Before You Click

The text arrives while you’re waiting for coffee: “USPS: Your package could not be delivered. Update your address here: usps-redelivery-secure.top.” You’ve been waiting on a package, actually. Your thumb hovers over the link. It says USPS. The timing is perfect. And that perfect timing is exactly why this works — what you’re looking at is, quite literally, the answer to the question “what is a phishing link“: not a tracking page, but a copy of a delivery site built to harvest your address, card number, and a “redelivery fee” of $3 that hands your payment details to a criminal crew.

So what is a phishing link, exactly? It’s any link in an email, text, DM, or QR code that pretends to take you somewhere legitimate — your bank, a delivery service, a streaming account — but actually takes you to a fake site designed to steal your login, payment details, or personal information. Sometimes clicking is only step one; the link may also try to install malware or trigger a fake “security warning” call. The link itself is the weapon, and learning to inspect one before tapping is one of the highest-value security skills you can own. This guide teaches you how links really work, how attackers disguise them, and what to do when you’ve already clicked.

What Is a Phishing Link Attack? The 5 Steps

Understanding the chain makes each link easier to spot, because you’ll know what the attacker needs you to do.

Step 1: The bait message. You get an email, text, or DM with a problem that needs fixing now — a failed delivery, a locked account, an unpaid toll, a prize. The FTC notes that these messages consistently pair urgency with a single call to action: click the link. Legitimate companies almost never ask you to update payment or account details through a link in an unexpected message.

Step 2: The disguised link. The visible text might read “usps.com” or “Verify Account,” but the real destination is hidden underneath. Attackers use lookalike domains (usps-delivery.top), URL shorteners (bit.ly/3xKq), and QR codes — which are just links you can’t read at all — to hide where you’re really going.

Step 3: The fake site. The page that loads is a pixel-perfect copy of the real thing, sometimes complete with the company’s logo, fonts, and even a working “back” button. Modern kits also show you a convincing loading animation. Your brain sees the familiar branding and relaxes. That’s the entire trick.

Step 4: The harvest. You enter your username, password, card number, or one-time code. The fake site forwards your credentials to the attacker in real time — and in the nastier variants, the attacker immediately logs into your real account with what you just typed, sometimes triggering a genuine 2FA code that you then hand over too.

Step 5: The cover. After harvesting, many fake sites redirect you to the real company’s actual website, so everything “looks fine” and you walk away unaware. Others show an error message — “session expired, try again later” — and vanish within days.

URL Anatomy: Reading an Address Like a Detective

A web address has structure, and scammers bet that you won’t read it carefully. Here’s the anatomy that matters.

Read from right to left. In usps.delivery-status.top, the real domain is delivery-status.top — the last two segments. Everything before the final domain name is just a subdomain the attacker controls for free. So secure.bankofamerica.verify-login.ru is not Bank of America. It’s verify-login.ru wearing a costume. Train your eye to find the true domain: it’s the part immediately before the .com, .top, .ru, or whatever the ending is.

Watch for lookalike spelling. Attackers register domains that survive a quick glance: paypa1.com (the number 1 instead of the letter l), micorsoft.com (missing an s), amaz0n.com, or an “rn” masquerading as an “m” — paypal becomes paypaI with a capital i. Homoglyph attacks can even use characters from other alphabets that look identical to Latin letters. If the domain doesn’t match the company’s real domain exactly, character for character, it’s not them.

Treat URL shorteners as opaque. A bit.ly or tinyurl link hides its destination by design. Scammers love them because you can’t inspect what you can’t see. Never enter credentials after following a shortened link; expand it first with a URL expander, or better, skip it and go to the site directly.

QR codes are links you can’t preview. Quishing — phishing via QR code — is rising fast because a QR code gives you zero information before you scan. Restaurant menus are fine; a QR code on a parking meter, a mailed letter demanding payment, or a random flyer deserves the same suspicion as any unknown link.

HTTPS does not mean legitimate. The padlock only means the connection is encrypted — scammers get free certificates too. A padlock on a fake site just means your stolen password travels securely to the thief.

How to Inspect a Link Before You Click

Make this a reflex. It takes about ten seconds once it’s habit:

• On a computer, hover. Rest your cursor on the link without clicking. Your browser shows the true destination in the bottom corner. If the preview doesn’t match what the message claims, don’t click.
• On a phone, long-press. Press and hold the link until a preview pops up showing the full URL. On iPhones and Android, this is the mobile equivalent of hovering — use it every single time.
• Check the sender, not just the message. A “bank alert” from a random Gmail address or a 10-digit phone number isn’t from your bank. Expand the sender field in email to see the full address — display names lie constantly.
• Ask the one question the FTC recommends: do I have an account with this company, or do I know this person? If the answer is no, treat the message as a likely scam, report it, and delete it.
• Go to the source yourself. Expecting a package? Open the carrier’s app or type their address yourself. Bank alert? Open your banking app. The company you need is always reachable without the link in the message — that’s the whole point.
• Never sign in from a linked page. Real platforms don’t need you to verify your account by typing your password into a page you reached from an email or text. That behavior, by itself, is the giveaway.

Red Flags That Scream “Phishing Link”

• Urgency plus a link. “Act within 24 hours,” “account suspended,” “final notice.” Pressure is the delivery mechanism for the link.
• Unexpected attachments or downloads. An “invoice.pdf” or “shipping-label.zip” you didn’t ask for can carry malware. Don’t open it.
• Generic greetings. “Dear customer” from a company that knows your name is a bulk-sent fake.
• Requests for passwords, Social Security numbers, or payment info by email or text. Legitimate companies don’t collect these this way.
• Threats or prizes. Both are emotional levers — fear and greed — designed to make you click before you think.
• Mismatched branding. Logos that look slightly off, odd fonts, broken English in a message from a major company.
• The message arrived somewhere weird. Your bank doesn’t handle fraud alerts via WhatsApp. Your payroll department doesn’t send tax forms from a personal Gmail.

You Clicked — Now What? Do This in Order

1. Stop. Don’t enter anything else. Don’t download anything the page offers. If a file downloaded, don’t open it — delete it.
2. Disconnect if something installed. If you ran a file or installed an app the page pushed, turn on airplane mode, uninstall the app, and run a full security scan with updated antivirus software.
3. Change the exposed password immediately — from a device you trust, by going to the real site directly. If you entered a password you reuse elsewhere, change it everywhere it’s used, starting with your email.
4. Turn on two-factor authentication on every important account, ideally with an authenticator app. If you handed over a 2FA code, assume the attacker used it and re-secure the account now.
5. Check for quiet damage. Look in your email for password-reset messages you didn’t request, new mail-forwarding rules, or unfamiliar recovery addresses — attackers often set these up silently. Scan bank and card statements for small test charges; thieves commonly probe with a tiny transaction before a big one.
6. If you entered payment details, call your bank or card issuer immediately and ask about freezing or replacing the card. Speed is the single biggest factor in whether a fraudulent charge can be stopped.
7. If you shared your Social Security number or ID, go to IdentityTheft.gov for a personalized recovery plan, and consider a credit freeze.

How to Report Phishing Links

• Forward phishing emails to reportphishing@apwg.org (the Anti-Phishing Working Group) — and use the “Report phishing” button in Gmail, Outlook, or Apple Mail.
• Forward scam texts to 7726 (spells SPAM) — your carrier uses these reports to block scam campaigns at the network level.
• FTC: Report at ReportFraud.ftc.gov. The FTC’s database powers real enforcement cases.
• FBI IC3: File at ic3.gov if you lost money or your identity was compromised.
• Your IT department if the message hit a work or school account — they need to know the campaign is targeting your organization.

Sources

1. BitLyft, “Phishing Attack Red Flags: Email Scams & Fraud in 2026” — https://www.bitlyft.com/resources/phishing-attack-red-flags-complete-guide-to-spotting-email-scams-in-2025
2. PointTech Pros, “What Is Phishing? Real Examples and How Not to Fall Victim” — https://pointtechpros.com/insights/what-is-phishing
3. TekDash, “How to Spot Phishing Scams” — https://tekdash.com/blog/how-to-spot-phishing-scams
4. Medium/HD Finance, “What the FTC Actually Says About Recognizing Phishing” (October 2026) — https://medium.com/@hdfinance979/what-the-ftc-actually-says-about-recognizing-phishing-b45d8134d249
5. SmartTechGuide, “What to Do If You Clicked a Phishing Link on Android: 8 Steps” (October 2026) — http://smarttechguide115.blogspot.com/2026/10/what-to-do-if-you-clicked-phishing-link.html

Last reviewed: October 2026

This article is for education only and is not financial or legal advice.

Related Guides

• Fake Charity Scam Signs: How Fraudsters Exploit Disaster Donations
• Holiday Shopping Scams 2026: Fake Stores, Phishing Deals and How to Shop Safe
• Is This Website Legit? 9 Checks to Verify Any Online Store Before You Pay