How To: Spot a Phishing Link

In short. The button text and the destination can disagree. Hover or long-press and read the real host. Do not click through “just to check”.

Apparent text versus actual URL

Phishing mail dresses the link as something you already trust: Verify account, Reset password, Pay supplier. The visible label is HTML. The href is where the browser goes.

• Desktop — hover and read the status bar or tooltip.
• Mobile — long-press and read the preview. Do not tap Open.
• Need to log in? — type the known site yourself in a new tab. Do not use the message’s URL.
• HTTPS — a lock only means the path is encrypted. It does not mean the host is your bank or IT.

Read the host, not the path. /intranet/password on a stranger’s domain is still a stranger’s domain.

Host tricks

• Lookalike brands — meridianbank-secure-login.example instead of secure.meridianbank.example.
• Extra words — conglomcorp-it-help.example instead of intranet.conglomcorp.com.
• Unrelated payment hosts — a Paperclip button that claims my.paperclipdirect.example but goes to scam-gateway.com.

In the simulator

• Tap or hover a link. The actual destination appears. The live URL is never followed.
• Typical miss: intranet-looking text, lookalike host underneath (conglomcorp-it-help.example, meridianbank-secure-login.example).