The link text is not the link
In an email, a document or a chat message, the words you see can be completely different from where the link actually takes you. A button saying 'View invoice' or text reading www.yourbank.co.nz can point anywhere. Scammers rely on people trusting what they see on the surface. On a computer, hover your mouse over the link without clicking and the real address appears, usually at the bottom of the window or in a small pop-up. On a phone, press and hold the link until a preview shows the address, then let go without opening it. Make this a reflex for any link that leads to a sign-in, a payment or a download.
How to read a web address properly
A web address has a structure. After https:// comes the host name, which ends at the first single slash. The part that matters most is the end of the host name: the domain and its ending, such as xero.com or ird.govt.nz. Everything before that is a subdomain, which the owner of the domain can set to anything they like. So in https://secure.westpac.co.nz.account-review.info/login, the real domain is account-review.info. The words westpac.co.nz are just a subdomain chosen to fool you. Reading from right to left, starting at that first slash, is the quickest way to cut through tricks like this.
Common tricks to watch for
Lookalike domains swap characters that look similar, such as a zero for an o, rn for m, or a capital I for a lowercase l. Others add a word, like microsoft-365-login.com, or change the ending from .co.nz to .com or .net. Some use letters from other alphabets that look identical on screen, though modern browsers often display these in a way that reveals them.
Shortened links from services that make long addresses short hide the destination completely. They're used legitimately in marketing, but in an unexpected email or text they deserve caution. Links to genuine file-sharing or form-building sites can also be abused, because anyone can create a free account and host a fake login page on a trusted domain.
Safer ways to check a suspicious link
The safest check is not to use the link at all. If an email says your Microsoft 365 password is expiring, open a browser and go to the Microsoft 365 portal yourself. If a supplier sends an invoice link, log in to their portal from a bookmark. This avoids having to judge the link at all. If you need to know where a shortened link leads, some link-preview services reveal the destination without visiting it, and your IT provider can check a link in an isolated environment. Avoid pasting suspicious links into random online checkers you don't know, since some of these are themselves dodgy.
Padlocks and https don't mean safe
Many people were taught that a padlock in the address bar means a site is safe. All it really means is that the connection between your browser and that website is encrypted. Scam sites get free certificates easily, so almost every phishing page now shows a padlock and https. What matters is whether the site belongs to who you think it does. A secure connection to a scammer's website is still a connection to a scammer. Check the domain, not the padlock.
Tools that help in the background
Good email security services rewrite or scan links when they arrive and check them again when clicked, blocking many known malicious sites. Web filtering on your firewall or on each device can block known phishing domains. Browser warnings from Microsoft Edge, Chrome and Safari also catch a lot. Keep these features switched on and browsers up to date. Password managers add an often-overlooked layer. They only offer to fill in your password on the exact domain where it was saved, so if your password manager doesn't recognise a login page that looks like Microsoft, that is a strong hint the page isn't real.
Links in documents, PDFs and QR codes
Links don't only arrive in emails. They're embedded in PDFs, Word documents, calendar invitations, shared notes and QR codes on printed letters. A link inside a document is no safer than one in the body of an email, and it's often harder to inspect because previewing the address takes an extra step. The same rules apply wherever the link lives. Check the real destination before you open it, be suspicious of anything that leads straight to a sign-in or payment page, and fall back on typing the address yourself when you can't see where a link goes.
In short
- Hover or long-press to see the real address before clicking.
- Read the domain from the first single slash backwards.
- A padlock means encrypted, not trustworthy.
- When in doubt, type the address yourself or use a bookmark.
- If your password manager won't autofill, be suspicious of the page.