What is link verification?
Definition
Link verification is checking where a link really goes before you click it, so you don't land on a fake site that steals your login, card details or personal information.
- Category
- Security
- Also called
- verifying a link, checking a link before clicking
- Last updated
Links lie. The words you see, "Reset your password" or "Track your parcel", can point somewhere else. Link verification means checking the real destination first.
The habit comes up most with phishing, where a scammer sends a message that looks like it's from a bank, a courier or a workplace and pushes you to click. CISA lists a mismatch between the link text and the address shown when you hover as a sign of a spoofed link. It also warns that URL shorteners can hide where a link goes.
How to check a link
On a computer, point at the link without clicking. The real address shows in the bottom corner of the browser, and CISA's guidance says to compare it with what the message claims. On a phone, press and hold the link to preview the address.
Look at the domain, the part right before the first single slash. yourbank.com.example-login.net belongs to example-login.net, not your bank.
The safest check skips the link entirely. For an unexpected message, open the company's app or type its website yourself. The FTC's advice for texts is the same: don't click links in unexpected messages, and contact the company through a website or number you know is real.
The other meaning
Apps and websites also use "link verification" for the email you get after signing up: click the link to prove the address is yours. That's a different use of the term. Treat those links with the same care if you didn't just sign up.
Why it matters
One careless click on a fake login page can hand over a password, which scammers then try on other accounts.
How to protect yourself
- 1
Hover or press and hold before you tap
Read the real address. If it doesn't match the message or looks odd, don't use it.
- 2
Go to the site yourself
Type the address or open the official app instead of using the link in an unexpected message.
- 3
Be wary of shortened links
A shortened link hides its destination. If you can't tell where it goes, ask the sender through another channel.
- 4
Turn on two-step verification
If you do enter a password on a fake page, a second factor makes the stolen password far less useful.
- 5
Reduce the messages aimed at you
Scam texts and emails often use contact details from data brokers. Serus finds where your phone number and email are listed and removes them.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
How can I tell if a link is safe?
Check the full domain, not just how it starts, and be suspicious of a mismatch between the displayed text and the real address. The safest option is to avoid the link and go to the site directly.
Can I check a link on my phone?
Yes. Press and hold the link to preview the address before opening it.
What does a shortened link hide?
The final destination. CISA notes criminals use URL shorteners to hide where a link leads.
What should I do if I clicked a bad link?
Don't enter anything. If you did, change that password right away, turn on two-step verification and change it anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.