Clicking is the risky part. You can learn a lot about a link without ever opening it.
1. Read the domain, not the start of the URL
The part that matters is the domain just before the first single slash. In https://paypal.com.account-verify.top/login, the real domain is account-verify.top, not PayPal. Scammers put a trusted name at the front to fool a quick glance.
2. Watch for look-alikes
Swapped letters (arnazon), extra words (amazon-support-help), and odd endings such as .top, .xyz or .click are common in scam links. These endings are not always bad, but they deserve a second look.
3. Be careful with shortened links
Short links hide the destination. Before opening one, expand it or run it through a scanner that follows redirects.
4. Ask whether you expected it
Unexpected messages that create urgency, such as a locked account, an unpaid toll or a failed delivery, are the classic pattern. Go to the real site yourself instead.
5. Use a scanner
A link scanner follows the redirects and checks the final destination against known threat lists. LinkGuard does this on your phone and returns a clear verdict with the reasons.
What a scanner cannot do
Brand-new scam pages may not be on any list yet. Treat a “safe” result as good news, not a guarantee. Never enter passwords or card details on a page you reached from an unexpected message.