Most attacks start with a click. Knowing how to read a URL and recognize a scam is one of the highest-leverage skills in digital hygiene.
Read the URL like a label
Look for HTTPS, the padlock icon, and the real domain. Attackers love lookalike domains (paypa1.com, micros0ft.support).
- Confirm the URL starts with https://.
- Click the padlock to inspect the certificate.
- Use Google Safe Browsing or VirusTotal to vet a URL.
Recognize phishing
Legitimate companies will not ask for passwords or sensitive data over email. Urgency, threats, and 'too good to be true' offers are red flags.
- Don't click links in unsolicited emails.
- Hover to preview a link before clicking.
- Verify by visiting the site directly in your browser.