How to Spot a Phishing Link in 10 Seconds
Many phishing attacks start with one link in an email. A quick check before you click can stop many of them. Here is how to do it, with real examples.
By Mohamad Bayram, security (SOC) engineer · November 5, 2026 · 5 min read
What is a phishing link?
A phishing link is a fake link in an email or message. It pretends to go to a site you trust, like your bank, PayPal or Microsoft. But really, it goes to a fake site made by an attacker.
The fake site looks real. When you type your password or card number, the attacker gets it.
You do not need special tools to protect yourself. You only need to look at the link the right way.
The 10-second check
Look at the real address before you click
The words you see on a button or link can say anything. What matters is where the link really goes.
- On a computer: move your mouse over the link, but do not click. The real address appears at the bottom corner of the window.
- On a phone: press and hold the link. A preview with the real address appears. Do not open it.
Example: the button says "Log in to PayPal", but the real address is paypal-account-help.net. That is not PayPal.
Find the real domain
The domain is the name of the website, like paypal.com. To find it:
- Look only at the part of the address before the first single slash "/" (after "https://").
- Read that part from right to left. Skip the ending (.com, .net, .org, .co.uk). The name just before the ending is the real website.
Look for letters that only look the same
Attackers buy names that look almost right. Read the domain slowly, letter by letter.
- paypa1.com: the number "1" instead of the letter "l"
- rnicrosoft.com: "r" + "n" together look like "m"
- amaz0n.com: the number "0" instead of the letter "o"
- An address that contains xn--: it can hide letters from other alphabets that look like English letters. Be extra careful.
Check that the link matches the sender
If the email says it is from your bank, the link should go to your bank's website. If an email "from Microsoft" sends you to a site that is not microsoft.com, stop.
Also look at the sender's email address, not only the name. The name can be anything. For example, a sender called "Microsoft Support" with the address [email protected] is fake.
Pressure + login request = stop
Phishing emails try to make you act fast, before you think. Watch for phrases like:
- "Your account will be closed in 24 hours"
- "Unusual sign-in detected. Confirm your password now"
- "Your payment failed. Update your card details"
If an email pushes you to log in or pay, do not use its link. Open a new tab and type the website address yourself, or use the official app.
More warning signs
- Short links like bit.ly/... hide the real address. Be careful when they come in a surprise email.
- Links made of numbers, like http://185.23.44.10/login. Real companies use names, not raw numbers.
- Attachments that open a login page, often .html or .htm files, or .zip files you did not expect.
- QR codes in emails that ask you to log in. Scanning a QR code is the same as clicking a link, but you cannot see the address first.
Myth: "The site has a padlock 🔒 (https), so it is safe."
Truth: the padlock only means the connection is private (encrypted). It does not mean the site is honest. Fake sites can have a padlock too. Always check the domain.
Already clicked? Do this
- You only opened the page and typed nothing: close it. The risk is much lower. If a file downloaded, do not open it. Delete it and run a scan with your antivirus.
- You typed a password: change it right away on the real website. Also change it anywhere you used the same password. Turn on two-step verification and sign out of other devices.
- You typed card or bank details: call your bank now, using the number on your card.
- At work: tell your IT or security team right away. Reporting fast helps them protect everyone.
Report the email so it gets blocked for others. In Gmail, open the email, click the three dots ⋮, then "Report phishing". In Outlook, click "Report", then "Report phishing".
How email services check the sender
Email services run three hidden checks. They show if an email really comes from the domain it says:
- SPF: Is this server allowed to send email for this domain?
- DKIM: Is the email signed by the domain, and unchanged since it was sent?
- DMARC: The domain owner's rule for what to do when the other checks fail.
A fail is a strong warning sign: the email may be pretending to be someone else.
But a pass does not mean the email is safe. Attackers can buy their own domain, like paypal-account-help.net, and pass every check for it. A pass only tells you who really sent the email. You still need the 10-second check for the links.
In Email2Chat: notifications in Telegram show the result of these checks, for example 🔒 SPF: PASS | DKIM: PASS | DMARC: PASS, or ⚠️ when the checks fail. So you can quickly see if a sender is pretending to be someone else, before you open the email.
Your 10-second checklist
- Hover (computer) or press and hold (phone) to see the real address.
- Find the real domain: the part just before the first single "/".
- Read it letter by letter: 1 vs l, 0 vs o, rn vs m.
- Does the link match the sender?
- Pressure to log in or pay? Type the address yourself instead.
Share this checklist with your family and team. One careful look can save an account.
Note: the website addresses in this article are examples to show the tricks. They do not refer to any real company or person.
Get your important emails in Telegram
Email2Chat sends each new email to Telegram, with an optional short AI summary and the sender checks shown above. Free to start, no credit card.