In short
Learn the one skill that stops most scams: reading who really owns a link. With examples of look-alike addresses and fake login pages.
Top warning signs: The brand appears, but not as the real domain; Look-alike spelling; Extra words.
First thing to do: Don't log in from links in messages. Use the app, or type the address yourself.
How the scam works
Phishing pages copy logos and layouts perfectly. The only part a scammer can't fake is the real domain name: the name right before the first single “/”, together with its ending (.com, .co.uk and so on).
Red flags to look for
- The brand appears, but not as the real domain. paypal.com.account-verify.info belongs to account-verify.info. Read from the right.
- Look-alike spelling. paypa1, arnazon, micros0ft, or special characters that look like normal letters.
- Extra words. secure-login-, -verify, -support, -refund.
- Shortened links. bit.ly and similar hide the destination. Our checker follows them for you.
- Brand-new domains. Days-old websites asking for logins are almost always phishing.
What to do if you get one
- Don't log in from links in messages. Use the app, or type the address yourself.
- Paste unsure links into TapSafely. We show the real owner, age and where the link really goes.
- Use a password manager: it won't auto-fill your password on a fake domain, which is a great early warning.
Read a link from right to left
| Link | Real owner | Verdict |
|---|---|---|
https://www.amazon.co.uk/orders | amazon.co.uk | Genuine domain |
https://amazon.co.uk.refund-centre[.]top | refund-centre.top | Fake |
https://login.microsoftonline.com | microsoftonline.com | Genuine domain |
https://micros0ft-login[.]com | micros0ft-login.com | Fake (zero instead of o) |
If you already paid or shared details
Act quickly. It makes a difference.
- Change the password on the real site, and anywhere else you used it.
- Turn on two-step verification and check account settings for new forwarding rules or devices.
- If you entered card details, call your bank.
More help: what to do after a scam, and where to report it in your country.
How to protect yourself next time
Use a password manager
It only fills in your password on the real website, so a look-alike login page gets nothing. It also makes a different password for every account, so one leak doesn't open the rest.
Free: Bitwarden has a free plan, and even the password manager built into your phone or browser beats reusing one password everywhere.
- NordPass Partner link Password manager with a free plan and a family plan for up to six people.
Turn on two-step verification, ideally with a security key
With two-step verification, a stolen password isn't enough on its own. A hardware security key goes further: it simply doesn't work on a fake site, so it can't be phished.
Free: Two-step verification is free. Switch it on in the security settings of your email, bank, WhatsApp and social media accounts today.
- YubiKey (Yubico) Partner link A small USB or NFC key you tap when you log in. It will not work on a fake site.
Compare the tools that help, and what each costs
Links marked Partner link may earn us a commission, at no cost to you. It never changes our advice, and the free option always comes first. Affiliate disclosure.
Questions people ask
Is a link safe if it starts with https?
No. https only means the connection is encrypted, not that the site is honest.
Have you had this one?
Tell other people what the message said and how it reached you. It helps someone recognise it before they tap.
No stories yet. Yours could be the one that warns someone.
Official sources and further reading
We check our guides against advice from government agencies and consumer protection bodies.
- How To Recognize and Avoid Phishing Scams (US Federal Trade Commission)
- Phishing scams: how to spot and report them (UK National Cyber Security Centre)
- Phishing scams (Scamwatch, Australian Competition and Consumer Commission)
