Check Before You Click: Avoiding Scams in 2026
Phishing is sharper than ever. A 60-second habit that keeps you safe.
Scam links in 2026 don't look scammy anymore. AI-written phishing emails have perfect grammar, fake login pages are pixel-perfect, and shortened URLs hide everything. The defense hasn't changed though: verify before you click. Here's the habit.
The 60-second link check
- Hover first. On a computer, hover your cursor over the link and read the real destination in the bottom-left of your browser. On mobile, long-press the link to preview the URL. If it doesn't match the supposed sender, stop.
- Read the domain carefully. Scammers rely on lookalikes:
paypaI.com(capital i),arnazon-support.net,bankofamerica-secure-login.com. The real domain is the part just before the first single slash — everything before that must match exactly. - Check the sender, not just the name. "Netflix Support" can display any name it wants — the actual email address is what matters. Free-mail senders (
@gmail.com) claiming to be your bank are an instant red flag. - Scan it. Paste suspicious URLs into Google's Safe Browsing check at transparencyreport.google.com/safe-browsing/search before opening them.
- When in doubt, go direct. Don't click the link at all — open your browser and type the site's address yourself, or use the company's official app.
Red flags checklist
- Unexpected attachment or "invoice" you didn't ask for
- Generic greeting ("Dear Customer") from a service that knows your name
- Requests for passwords, OTP codes, or remote-access software
- Too-good-to-be-true offers (free crypto, surprise inheritances)
- QR codes in emails ("quishing") — treat them like links and verify the destination
If you already clicked
Don't panic: 1) disconnect from the internet, 2) don't enter any information, 3) run a full antivirus scan, 4) change passwords for important accounts from a clean device, 5) enable two-factor authentication everywhere, and 6) report the phishing page at safebrowsing.google.com/safebrowsing/report_phish.
Conclusion
Scams work because they're fast and emotional. Your entire defense is one pause: hover, read, verify. Make it a reflex and you'll sail past 99% of phishing attempts.
