What is the easiest phishing sign to check?
Check whether the final registered domain actually belongs to the organization named in the message.
How to Tell If a Link Is Phishing
1. The domain does not match the company
A phishing URL may contain a brand name while the actual registered domain belongs to someone else. Do not judge a link by the first familiar word you see; identify the real hostname and compare it with the service's known domain.
Small substitutions such as extra hyphens, swapped letters, added words and internationalized lookalikes are common ways to make a domain feel familiar at a glance.
2. The link creates urgency around an account
Messages that claim your account will be closed, a payment failed, a parcel cannot be delivered, or suspicious activity requires immediate verification are designed to shorten your decision time.
Urgency alone does not prove phishing, but an unexpected login request combined with a questionable domain is a strong reason to stop and verify independently.
3. The page asks for information the sender should not need
Be especially cautious with requests for passwords, recovery phrases, one-time codes, full card details or identity documents. Legitimate support teams generally do not need you to reveal secrets through an unsolicited link.
Password managers can also provide a useful clue: if your saved credentials do not recognize the domain, check the hostname carefully instead of manually typing the password.
4. HTTPS does not prove legitimacy
A phishing website can obtain a valid TLS certificate and display a padlock. HTTPS protects the connection to that domain; it does not certify that the domain belongs to the company shown on the page.
Treat HTTPS as a baseline security feature, not a trust badge. Domain ownership and message context remain essential.
Questions
Frequently asked questions
Can phishing links come from a real person's account?
Yes. Compromised email and social accounts can send malicious links from people you know.
Does a phishing checker guarantee a link is safe?
No. New phishing pages may not yet be known, and some attacks change content depending on the visitor.
Should I reply to ask if the sender is real?
For a suspicious or high-value request, verify through a separate channel you already trust rather than replying to the same conversation.
Related
Keep checking safely
Check the link before you open it
Paste the suspicious URL into Can I Share This? for a fast, privacy-first risk assessment.