How to check a link before you tap it

A fake page can copy a bank's look perfectly. It cannot copy the bank's address. Learn to read the address and most phishing fails.

Find the real domain

Every web address has one part that says whose site it is: the domain. To find it:

Start after https://.
Stop at the first single slash / (or the end, if there is none). Ignore everything after it.
In what is left, read from the right: the ending (.com, .in, .gov.in, .co.in) and the one word just before it are the domain.

Address	Real domain	Whose site
https://www.mybank.example/personal	mybank.example	The bank, if that is the address the bank itself publishes
https://mybank.secure-login.co/kyc	secure-login.co	Someone else. "mybank" is only a label in front
https://secure.example.com.verify-user.in/login	verify-user.in	Someone else. "example.com" in the middle means nothing
https://example.com/mybank/login	example.com	example.com. "mybank" is only a folder name
https://sancharsaathi.gov.in/sfc/	sancharsaathi.gov.in	A Government of India site

The trick in nearly every phishing link is to put the trusted name somewhere it does not count: before the real domain as a sub-part, or after the slash as a folder.

Look-alike spellings

Swapped letters: rn for m, 0 for o, 1 or capital I for small l, vv for w.
Added words: -support, -kyc, -rewards, -secure, -india, -care joined to a brand name. Brands rarely use such addresses.
Wrong ending: .co, .xyz, .top, .online, .info where the real site uses .com, .in or its own ending.
Foreign letters that look the same, which may show in an address as text beginning xn--.

Government and bank addresses in India

Indian government sites end in .gov.in or .nic.in. A page about a government scheme on a .com, .org or .in address is not official, whatever its logo.
For your bank, take the address from your passbook, your card or the bank's own app, not from a message or a search advertisement, and save it as a bookmark.

The padlock means less than you think

The padlock or https says only that the connection to that site is encrypted. Fraudulent sites have padlocks too. It tells you nothing about who runs the site.

Shortened links and QR codes

Short links (a few letters after a shortener's name) and QR codes hide the destination. On a phone, press and hold a link to see the full address before opening. If you cannot see where it leads, do not follow it from a message; go to the organisation's app or type its address yourself. Our link checker takes a web address apart on your own device and points out warning signs.

The safest habit

For anything involving money, identity or passwords, do not use links in messages at all. Open the app, use a bookmark you saved yourself, or type the address. A genuine notice will also be waiting inside your account when you log in the normal way.

If you tapped a bad link

Only opened it: close the page. On an updated phone, merely opening a page rarely causes harm.
Typed a password: change it at once on the real site, and anywhere else you used it. Turn on two-step verification.
Typed card or bank details or an OTP: call your bank to block the card and see after a fraud.
Installed something: see APK file scams.
Report the link on Chakshu at the Sanchar Saathi portal, which takes reports of suspicious web links.

Is a site with https always safe?

No. It only means the connection is encrypted. Check the domain.

How can I tell if a .in or .com site is official?

The ending alone does not tell you. Compare the domain, letter by letter, with the address printed on official documents or shown inside the organisation's own app.