How to spot a scam link
Scam links look convincing. A few simple habits make them much easier to catch.
Verify › Guides › How to spot a scam link · Last updated 18/10/2026
Read the website name, not the whole link
The part that tells you who owns a link is the website name just before the first single slash. Anything to the left of it is decoration that scammers can choose freely. For example, in your-bank.secure-login.example/account the real website is secure-login.example, not your bank. In https://www.yourbank.co.uk/login the website is yourbank.co.uk.
Common warning signs
- Extra words such as secure, login, refund or verify added to a familiar brand name.
- Misspellings and swapped characters, such as a capital I in place of a lower-case l.
- Shortened links (such as ones that hide the destination) in messages you did not expect.
- A brand new website. Scam sites are often only days old, which is why Verify checks how long a website name has existed.
- Urgency or threats: a fine, a missed delivery, a frozen account.
The padlock does not mean a site is safe
The padlock only means the connection to the website is encrypted. Scam websites can have one too. It does not tell you who runs the site or whether you can trust it.
What to do instead of clicking
Go to the organisation directly. Type its address yourself, use its official app, or call the number on your card or latest statement. If a message is genuine, you will be able to find the same thing by logging in the normal way.
Check a link with Verify
Open Verify, choose Web link and paste the address. You get a red, amber or green answer with a plain-English reason, and you can see the score and every check behind it. Verify gives guidance only, so if anything feels wrong, do not proceed.
Report scam messages
- Forward scam texts to 7726 (free).
- Forward suspicious emails to report@phishing.gov.uk.
- If you have lost money, report it to the Report Fraud service in England, Wales and Northern Ireland, or call Police Scotland on 101.
Check a QR code, link or phone number
Common questions
Does https and the padlock mean a link is safe?
No. It means the connection is encrypted, not that the website is trustworthy. Scam websites regularly use https.
Is a long link a sign of a scam?
Not by itself. Judge a link by the website name just before the first single slash, and by whether you expected the message.
Can I check a link without opening it?
Yes. Paste it into the Web link tab on Verify and it is checked without you visiting the page.
More guides
Verify gives guidance only and cannot guarantee that any link, code or number is safe. If something feels wrong, trust that feeling and check another way.