A WhatsApp message promises a payment, warns that your bank account will be restricted, or asks you to confirm a delivery. The logo looks familiar and the sender may be someone you know. Before opening the link, separate two questions: does the message make sense, and what is known about the destination?
A link checker can provide evidence about a URL. It cannot establish that a sender is genuine or guarantee that an unfamiliar destination is harmless. A sensible check combines the address, the message and independent confirmation.
1. Pause before acting on the message
Pressure is a reason to investigate. Watch for requests to act immediately, pay a small fee to receive a larger benefit, provide a password, or disclose a one-time code. None of those clues proves fraud on its own, but together they can identify a risky request.
If a contact sent the message, confirm through a separate conversation. Their account could have been compromised, or they may have forwarded a claim without checking it. Do not ask for verification only inside the same suspicious interaction.
For a bank-related claim, open the banking app you already use or obtain contact details from the bank's established official website. For a parcel, use the courier's official tracking channel. Do not use a telephone number supplied only by the questionable message.
2. Inspect the actual address
Read the hostname, not just the displayed brand. A URL such as `https://bank.example.attacker.test/verify` belongs under `attacker.test`; the familiar-looking words before it do not make it a bank website. This example is illustrative, not a real destination to visit.
HTTPS means the connection can be encrypted. It does not mean the business behind the website is trustworthy. A shortened link also hides the destination, making it harder to evaluate before navigation.
On a phone, copying a link often involves a long press, but controls differ between apps and versions. Avoid tapping the preview or open action by mistake. If you cannot safely inspect it, verify the claim through the official service instead.
3. Check public threat signals without submitting secrets
You can use Guardian's suspicious URL checker to examine available threat signals. Read which sources responded and whether results are current or unavailable; a verdict without its coverage tells only part of the story.
Before submitting a URL to any checker, inspect it for private tokens. Password-reset links, document invitations and account-verification links can contain access credentials in their query strings. Avoid submitting those complete URLs to third-party services. If a generic domain lookup is appropriate, investigate the hostname separately while recognizing that domain-level evidence may not describe the exact page.
4. Check the message or screenshot too
A legitimate website can appear in a fraudulent message, and a malicious page may not yet appear in a feed. Use Guardian's message or screenshot-text analysis as another source of context.
Review extracted screenshot text for mistakes before analysis. Remove personal details, account numbers, passwords and one-time codes. An AI explanation can help identify suspicious wording, but it can also misunderstand context. Screenshot-text analysis is not proof that an image is authentic or a deepfake detector.
5. Treat “no detections” carefully
A newly created phishing page may have little public history. A clean result can mean that available sources have no detection, not that the site has been proven safe. Likewise, a hosting provider's poor IP reputation does not automatically establish that every domain on that infrastructure is malicious.
If you need more evidence, use the indicator investigation workspace and examine source dates and coverage. For emerging reports, review available phishing and malware indicators. An unlisted indicator is still a judgment call.
If you already clicked or shared information
Clicking and entering a password are different events. If you entered credentials, change them through the genuine service, review active sessions and enable stronger authentication where available. If money or bank access is involved, contact your financial institution promptly through its official channel. If you downloaded a file, do not run it; seek appropriate device-security help.
Keep the message and relevant timestamps as evidence without forwarding the suspicious link to more people. Check current reporting guidance from ngCERT or the affected organization's official support channels.
The useful habit is not simply “scan and trust.” It is to inspect the destination, understand the request and verify the claim independently. Start with Guardian when a voluntary check can add evidence; use the official service whenever account access or payment is involved.
Sources and further reading
- CISA: Recognize and Report Phishing
- ngCERT