Scam guide · Links

How to check if a link is safe before you open it

By Aman Gupta, 12+ years in cyber security · Updated 7 October 2026

The short answer

Before you tap a link, read the real address (the part before the first single slash), be suspicious of shortened links and lookalike spellings of bank or government names, and check it with a link scanner that asks several threat lists, such as Google Safe Browsing and VirusTotal. A padlock (https) only means the connection is encrypted; scam sites have padlocks too.

1. Read the real address

The only part of a link that tells you who owns the page is the domain: the words just before the first single /. In https://sbi.co.in.kyc-update.top/login the owner is kyc-update.top, not SBI. Everything to the left of it can be made up.

Lookalike spellings: paytrn for paytm, hdfcbank-in, an extra word like -kyc, -reward or -refund.
Odd endings for a bank or government page: .top, .xyz, .click, .site. Indian banks use their own domain; government sites end in .gov.in or .nic.in.
A long string of random letters, or a bare number address like http://45.12.x.x.

2. Treat short links as unknown

Shortened links (bit.ly, tinyurl and similar) hide where they go. They are not bad by themselves, but in a message about your bank, electricity bill, parcel or a prize, assume the worst until you know the destination. A link checker that follows the redirects for you shows the final page without your phone visiting it.

3. Look at the message, not just the link

Most scam links arrive with pressure: your account will be blocked today, your electricity will be cut tonight, your KYC has expired, you have won a reward. Real banks and utilities do not ask you to update KYC or pay through a link in a WhatsApp message. If in doubt, close the message and open the official app or website yourself.

4. Check it with a tool that asks more than one source

No single list knows every scam page. A new phishing page is often missing from one list and already flagged in another. Free ways to check:

Google Safe Browsing site status (Google Transparency Report).
VirusTotal, which asks dozens of security engines about one address.
SecureOne's link scanner, which asks Google Safe Browsing, VirusTotal and URLhaus together, follows redirects on its server rather than on your phone, and shows each source's answer separately.

"No warning found" is not the same as "safe". A page made an hour ago may not be on any list yet. If the message itself feels wrong, trust that.

5. If you already tapped it

Do not enter anything: no card number, OTP, UPI PIN or password.
If you did enter details, call your bank on the number printed on your card and block the card or UPI.
If money was taken, call 1930 (National Cyber Crime Helpline) as soon as possible and report at cybercrime.gov.in. Speed matters for getting money held.
If a file downloaded, do not open it. Delete it.

Where SecureOne helps, and where it can't

SecureOne checks any link you paste or share to it against three sources, and, if you turn on notification scanning, checks links that arrive in WhatsApp, Telegram and SMS notifications before you tap them. It never reads or uploads the message text, only the link. It cannot promise a page is safe; its best answer is "no warning signs found".

Get SecureOne for Android · See every feature and its limits

Quick answers

Does https or a padlock mean a website is safe?

No. The padlock only means the connection is encrypted. Scam websites get free certificates too, so most phishing pages today show a padlock.

Is it safe to open a bit.ly or short link?

Not until you know where it goes. Use a link checker that follows the redirect for you, especially if the message is about money, KYC, a parcel or a prize.

What should I do if I clicked a scam link?

Do not enter any details. If you entered bank details, call your bank on the number on your card to block it. If money was lost, call 1930 and report at cybercrime.gov.in quickly.

Lost money to a scam? Call 1930 (National Cyber Crime Helpline) and report at cybercrime.gov.in as soon as you can.

← All scam guides