Staying Safe Online · Email & Message Tricks · Lesson 3 of 5

Check Before You Click

See where a link really goes and read a web address the safe way.

See where a link really goes

A link is words or a button you click to go to a web page. The words on a link can say anything. 'Sign in to your bank' might really go to a scam site.

You can peek before you click. Hovering means resting your mouse pointer on something without clicking. Hover over a link, and the real address appears in the bottom corner of your browser or email window.

On a phone or tablet, press and hold the link instead. A box shows the address. Tap outside the box to close it without opening the link.

Now read the address the safe way. Find the first single slash (/) after the name. Then read to the left of it. The real name of the site sits just before the ending, like .com, .org or .net.

• www.amazon.com/orders: the part before the first slash ends in amazon.com. That is Amazon.
• amazon.com.order-check.net/login: before the slash, it ends in order-check.net. That is not Amazon. The word amazon at the start is just a costume.
• www.paypal.com.secure-help.co/sign-in: the real name is secure-help.co.

Ignore the 'https://' at the very start. Its two slashes don't count.

Attachments and going there yourself

An attachment is a file sent along with an email, like a photo or a document. Most are fine. Some are dangerous.

A bad attachment can install a harmful program when you open it. A harmful program is called malware. It can spy on you, steal passwords or lock your files.

Be careful with attachments that:

• You weren't expecting, even from someone you know. Their account may have been taken over.
• Come with pressure, like 'Open the invoice now'.
• Are zipped files (ending in .zip), or ask you to 'enable content' or 'enable editing' to see them.

If a friend sends a surprise file, ask them first. Use a new message or a phone call, not a reply to that email.

Here is the best habit of all. Go to the site yourself. Instead of clicking a link in a message:

1. Open your browser.
2. Type the company's address you already know, or use a bookmark you saved.
3. Sign in there and look for the problem.

You can also open the company's official app. If your account really needs something, you will see a notice after you sign in. If there's nothing there, the email was most likely fake.

This one habit beats almost every phishing trick.