How to check whether a link is safe before you click

A link in an email, message or advert can lead to a fake page that steals passwords and card details, or start a harmful download. Criminals send millions of such messages, and sooner or later one reaches someone in your company. A few seconds of checking can save you a lot of trouble.

Why checking matters

• One employee's stolen password can open access to the whole company mailbox.
• Fake invoices and "urgent" payment requests often come through links.
• Malicious files can lock all your data and demand a ransom.

5 ways to check a link

1. Ask the sender through another channel, for example a phone call, if the message is unexpected. Colleagues' accounts can be hacked, too.
2. Look at the address. Hover the mouse over the link (on a phone, press and hold) and read the real address. Watch for misspelled names (paypa1.com), unusual endings, long random strings, and addresses that start with the right brand but continue with something else, like yourbank.com.secure-login.xyz. The real domain is the part right before the first single slash.
3. Use a free online checker. Paste the link, without opening it, into VirusTotal (checks it with dozens of security engines), URLScan.io (shows what the page looks like without you visiting it) or Google's Safe Browsing check.
4. Install a browser protection extension that warns about dangerous sites.
5. Keep antivirus on your computer and phone, and keep your system and browser updated.

Links you should not click

• Messages that rush you: "Your account will be closed in 1 hour!"
• Unexpected prizes, refunds, tax returns or parcels you did not order.
• Shortened links from unknown senders, because the real address is hidden.
• Links that ask you to log in to a bank or work account from a message. Open the site yourself by typing the address instead.
• Attachments or downloads you did not ask for, especially archives and files that ask to "enable macros".
• Messages with spelling mistakes, strange greetings or a sender address that does not match the company.

If you already clicked

• You only opened the page: close it, clear the browser cache and run an antivirus scan. Usually nothing more is needed.
• You typed a password or card details: change the password at once (and anywhere you reused it), enable two-factor authentication, call your bank to block the card and watch your accounts for strange activity. Tell your colleagues, because the same message may have reached them.
• A file started downloading: do not open it. Delete it and scan the device. If it was already opened, disconnect the device from the internet and contact your IT support immediately.

Build good habits in the team

• Use a password manager, so passwords are never typed into a strange page by habit.
• Turn on two-factor authentication everywhere you can. Even a stolen password then is not enough.
• Agree on one rule: payments and changed bank details are always confirmed by phone.
• Once a year, run a short training and send a harmless test message to see who clicks.

The main points

• Do not trust urgency.
• Check the real address before clicking.
• Use two-factor authentication.
• If in doubt, ask. A minute of questions is cheaper than a day of recovery.