Is this email a scam? Check the link first.

Got a whole message, or a phone call, rather than a link? Describe it in a few words, or paste the message, into our guide search: it shows which of our guides may match, with the rules that hold for every scam. Already clicked or paid? Go straight to what to do now.

How to read a link in ten seconds

You can do most of this without a tool. Every web address has one part that tells you whose site it is, and you can find it yourself.

1. Find where the website name ends. Skip the https:// at the start. The website name runs until the first /, ? or #, or to the end if there's none of those. If you see an @ or a backslash \ before that point, stop and use the checker: both can hide the real name. Use it too if part of the name starts with xn--, or if a second web address appears later in the link: letters from other alphabets, and links that send you on, can't be checked by eye. And in a message, a letter, dot or slash from another alphabet or symbol set doesn't show up as xn--: it can look exactly like an English one, so a link that matters is worth pasting into the checker too.
2. Read the last two parts of the name, the words on either side of its last dot. That's the registered domain, such as irs.gov or wellsfargo.com. A few endings have two parts, like .co.uk; then read three.
3. Ask: is that exactly the address I expect? It has to match the company's real address letter for letter. Anyone can register a name that holds a company's name with a word added, such as wellsfargo-secure.example, or the same name with another ending. If you're not sure of the real address, get it from your card, a statement or a letter you trust, not from the message. Usually the owner of that domain controls the page, and the words in front of it and after the slash can say anything at all, though if those words include a second web address, the link may send you on to it. But some big companies let anyone publish under their address: Google Sites and Forms, PayPal invoices and payment links, Cash App and Venmo payment pages, app-store listings. A familiar name there doesn't tell you who made the page.

Even a perfect match isn't a reason to tap a link in a message. The FTC says that if you get an email or text from a company you do business with and you think it's real, "it’s still best not to click on any links." Instead, type the address you know, or open the company's app.

Here are three made-up addresses with the registered domain highlighted, the way our checker shows it:

• https://www.paypal.com.account-review.example/signin
  This page belongs to account-review.example. The "paypal.com" in front is just words its owner chose.
• https://secure-login.example/amazon/orders
  This belongs to secure-login.example. "amazon" here is only the name of a page.
• https://www.chase.com@login-verify.example/secure
  Everything before an @ is skipped. This goes to login-verify.example.

How to copy a link without opening it

• On a computer: point at the link without clicking. In most browsers and email programs the real address appears in a small box, at the bottom corner of the window or next to the pointer. To copy it, right-click the link and choose "Copy link" or "Copy link address."
• On a phone or tablet: press and hold the link until a menu appears, then tap "Copy" or "Copy Link." Some phones also show a preview of the page there; you don't need it, so go straight to Copy.
• For the sender's address: in most email programs, click or tap the sender's name to see the full address behind it.

What the signs mean

The checker looks for these things. None of them is proof on its own; each is worth a second look.

Letters from another alphabet

Some alphabets have letters drawn exactly like English ones: a Cyrillic "а" looks just like an English "a." Addresses with letters like these are stored as codes that start with xn-- (that's the internet standard for these names), followed by the letters written in a system called Punycode, and the checker shows you both.

A familiar name in the wrong place

A company's name in front of the registered domain, or after the website name ends (the first /, ? or #), proves nothing, because the site's owner wrote it there.

A familiar name inside someone else's domain

A company's name joined to other words in the registered domain, like chase-alerts.example, can be registered by anyone. Some companies do own names like this, and the checker can't tell which, so compare it with an address you already know, such as the one on your statement or card.

A familiar name with a different ending

A company's name with an ending other than the one you know, such as .net or .co instead of .com, can be registered by anyone too. Some companies own several endings, so compare it with the address you already know.

One or two letters away

A swapped letter, a 0 for an o, or "rn" for "m." The FTC's advice is to look for misspellings or a switched letter. The checker compares the registered domain with a short list of names that official alerts mention often.

A number instead of a name

A link to a bare internet address, like four numbers separated by dots, tells you nothing about who runs it.

A short link

Link-shortening services hide the real destination until you open it. The checker can't follow a short link, because it never connects to anything.

http instead of https

Real sign-in and payment pages use https, which keeps what you type private on the way. The reverse isn't true: anyone can get https for free, so it says nothing about who runs a site.

An @ sign before the website name

The technical rules for web addresses allow a user name before an @ sign, and browsers skip it when deciding where to go. Honest links almost never use it; it can make a link look like it starts with a name you trust.

An unusual ending

Most U.S. companies and agencies use .com, .org, .net, .gov or .edu. Plenty of honest sites use other endings, so this is mild. Addresses ending in .gov are only available to U.S.-based government organizations.

A very long or coded link

Long links are common (companies add tracking codes), but they're hard to read, and on a phone the registered domain can scroll out of view.

An address inside an address

Some links carry a second web address inside them. Email services wrap links this way, and so do people who want a familiar first half to carry you somewhere else. The checker shows the inner address and lets you check it too.

A space on a hosting service

Some endings belong to services that hand out addresses to their customers. The checker uses the Public Suffix List to recognize them, and tells you when the name in front was chosen by one of those customers.

A page anyone can publish

Some big companies let their users publish on the company's own address. Anyone with a Google account can make a website with Google Sites or share Google Drive files with anyone. Choosing a Cash App name creates a payment page at cash.app/$ and that name, PayPal lets its users make payment links, a business that sells through PayPal sends buyers to a PayPal checkout page for its own order, and PayPal warns that scammers send fake invoices and money requests through PayPal. Anyone with an Adobe account can publish a web page made with Adobe Express or share a PDF with anyone who has the link, and anyone can share a chat with Google's Gemini as a public page. A link to one of these shows a familiar address, but a stranger made what's there, and money sent through a payment page goes to whoever made it. The checker knows the common ones (pages and shared files on Google, Microsoft, Apple, Adobe and Dropbox; Cash App, Venmo and PayPal payment and checkout pages; app-store listings; Facebook and Instagram pages) and says so. No list like this is complete, so a familiar address with no sign still doesn't tell you who made the page.

An email service anyone can use

Anyone can open an address at gmail.com, outlook.com, yahoo.com, aol.com or icloud.com in minutes, under any name. Banks, agencies and big companies normally write from their own domain: the IRS, for example, says it emails only when you opt in (apart from its criminal investigators, who may "Call or email with questions connected to a criminal investigation"), and that its account emails come from addresses ending in irs.gov. So a message "from the IRS" or "your bank" sent from a free account is a strong reason to check with them directly.

A familiar name before the @

If the part before the @ says "irs.gov" or "chase" and the part after it is gmail.com, the address belongs to a Gmail account, not to the IRS or the bank. Whoever opens an account chooses the name before the @.

A web address hidden at the start

An address like ezpass.com-tolls.example starts with something that reads like a complete address. The real one is com-tolls.example: everything in front was chosen by whoever registered it.

A remote-control program

Links to programs that let someone else control your computer, such as AnyDesk, TeamViewer, Chrome Remote Desktop, and Quick Assist, Microsoft's own tool for Windows and Mac computers. Microsoft has warned that scammers pretend to be Microsoft support to get people to use Quick Assist. The FBI's advice: "Do not download software at the request of an unknown individual who contacted you."

A sign-in page for a code someone gave you

Microsoft has a real page for signing in on a TV or another device by typing a code. Microsoft has warned that attackers send people there with a code of their own: typing it signs the attacker in to the person's account. The checker gives a link to that page a sign of its own instead of the note about Microsoft's address. Only type a code there that you see on a device you're setting up yourself.

A link to a program or a file

A link that ends in .exe, .msi, .dmg, .apk, .zip and the like downloads a file that can install or run a program. Don't open one because someone who contacted you asked you to.

A government name outside .gov

An address like dmv-renewal.example uses a government office's name but doesn't end in .gov. Only government organizations can get a .gov address; anyone can register a name like this one.

What this checker can't tell you

It reads the address and nothing else. It never opens the link, so it can't see the page, follow a short link or a forwarding link, or know whether a site is brand new or has been reported. Its lists of familiar names, short-link services and pages anyone can publish are short, so a link can slip past all of them. A real company's address can also turn up in a scam message: a page someone published on it, an invoice sent through it, or a genuine sign-in page you reached from a message you didn't expect. And the sender's address on an email can be faked, so even a familiar one doesn't prove who wrote the message. That's why it shows signs to weigh, never a verdict.

In an email, the words of a link can be different from where it really goes. Copy the link itself (right-click it, or press and hold it on a phone, and choose Copy link), not the words you see.

The message around a link matters as much as the link. What does it want you to do, and how soon? Our guide search finds the guide that explains that kind of message.

Four questions to ask about any message

The FTC's guide "How To Avoid a Scam" lists four common signs of a scam. As questions:

1. Does it claim to be from an organization I know? The FTC says scammers often pretend to be contacting you on behalf of the government, and some pretend to be from a business you know, like a utility, a tech company or even a charity.
2. Is there a problem or a prize? You owe money, an account is locked, a relative is in trouble, you've won something.
3. Am I being rushed? As the FTC puts it, "Scammers want you to act before you have time to think."
4. Am I being told to pay in one particular way? Cryptocurrency, a wire transfer, a payment app or a gift card.

If the answer to any of them is yes, the FTC's advice is to stop and talk to someone you trust before you do anything.

The numbers, plainly

In the FBI's 2025 IC3 Annual Report, people aged 60 and over filed 201,266 complaints and reported $7.75 billion in losses. Tech-support and customer-support scams accounted for $1.04 billion of that. Phishing complaints from that age group, about messages like the ones this checker reads, rose from 2,856 in 2023 to 48,064 in 2025. Over the same years, phishing complaints from people of all ages fell, from 298,878 to 191,561, so, in our reading (the FBI doesn't say this), the rise among older people may partly reflect who files complaints and gives an age, not only how much phishing there is. The FBI notes that these count only the complaints people filed, and only where they gave an age.

We use those numbers to decide what to explain, not to alarm anyone. The common scams pages walk through the patterns behind them, one at a time.