How to Check a Suspicious Link Safely Before You Click It

Overview

Phishing links are designed to create urgency and reduce careful decision-making. A message may appear to come from a colleague, supplier, bank, cloud service, or delivery company, while the destination leads to a credential-harvesting page, a malware download, or a fraudulent payment request. Some links are obvious; others use compromised legitimate websites, shortened URLs, or redirects that conceal the final destination.

The safest approach is to separate inspection from browsing. First preserve the message and its context. Then examine the link without opening it, assess the destination and any redirects, and use security controls before deciding whether the link is necessary. A malicious link checker can support this process, but it should not replace URL inspection, endpoint protection, or employee reporting.

For a small business, the goal is not to make every employee perform advanced threat analysis. It is to establish a repeatable decision path: pause, inspect, verify through a separate channel, report when appropriate, and isolate a device if a link was opened.

Step-by-step workflow

1. Pause and preserve the message

Do not click the link, open an attachment, reply to the sender, or use contact details included in the message. Keep the original email, chat message, text, or QR code available. If your organization has a reporting button, use it according to your internal process. Preserving the message helps an administrator review the sender, headers, URLs, attachments, and delivery context.

Urgency is not proof of fraud, but it is a reason to slow down. Requests involving passwords, payment changes, gift cards, payroll, remote access, or sensitive documents deserve independent verification.

2. Reveal the destination without opening it

On a computer, hover over a link to display its destination in the browser or mail client status area. Do not click while inspecting. On a phone, use the operating system’s link preview or press-and-hold behavior only if you understand how that application handles previews. If there is any uncertainty, leave the message unopened and ask an administrator or security contact to examine it.

Copying a link can be useful, but take care not to paste it into a browser address bar and press Enter. A copied URL can be reviewed as plain text or submitted to an approved analysis service. Avoid sending confidential URLs containing access tokens, password-reset values, customer identifiers, or private document references to a public scanner.

3. Read the URL from right to left

In a typical web address, the important registered domain appears before the first single slash after the domain and is generally the last meaningful name before the top-level domain. For example, in https://login.example.com/account, example.com is the domain to evaluate. A long subdomain such as secure-login.example.attacker.test belongs to attacker.test, not to the brand suggested by the earlier words.

Look for misspellings, unexpected domain endings, extra hyphens, unfamiliar country-code domains, and domains that imitate a trusted name. HTTPS indicates an encrypted connection, not that the site is legitimate. A scam site can also use HTTPS.

4. Watch for shortened links and redirects

Shortened URLs hide the destination and should be treated as an additional review step, not as evidence of safety. If a link is business-critical, verify it through a known bookmark, the organization’s official website, or a trusted contact channel rather than following the shortened address from the message.

Redirect chains can move a visitor through several domains before reaching the final page. A URL inspection service may show redirects, reputation information, or technical details, but results can vary as websites change. Treat an unknown or inconclusive result as a reason not to proceed. Do not use a scanner as permission to enter credentials.

5. Decode QR codes cautiously

A QR code is simply another way to deliver a link. A QR code phishing scam may appear on a poster, invoice, parcel notice, meeting-room sign, or email. Scan it only when the source and purpose are expected, and inspect the resulting URL before opening it. On a managed device, a mobile security control or DNS policy may block known malicious destinations, but that protection is not a substitute for checking the domain.

Be especially careful when a QR code asks you to sign in, update payment information, install an application, or move a conversation to a private messaging service. Navigate to the service through a known app or bookmark instead.

6. Verify the request out of band

If the message claims to be from a colleague, supplier, executive, or service provider, confirm the request using a contact method you already trust. Do not use the phone number, email address, or reply path supplied in the suspicious message. For payment or account changes, use the organization’s established approval process rather than making an exception for an urgent request.

7. Decide, report, and document

If the destination is unexpected, the sender cannot be verified, or the request involves sensitive information, do not open it. Report the message through the company’s designated channel and delete or quarantine it according to policy. Administrators should record the affected users, message subject, sender, destination domain, and time of reporting without circulating the live link unnecessarily.

If someone already opened the link, stop interacting with the page. Do not enter credentials, download files, approve an unexpected sign-in, or dismiss security warnings. Disconnect the device from the network if malware may have executed, contact IT, and follow the organization’s incident process. For a fuller response sequence, see What to Do After Clicking a Phishing Link at Work.

Tools and handoffs

Tools should support a clear handoff rather than encourage employees to investigate beyond their role.

• Mail and collaboration controls: Use reporting features, message quarantine, attachment scanning, and link protection where available. For Microsoft 365 environments, connect suspicious-message reporting to the team that can review and contain accounts.
• Malicious link checkers: Use an approved URL reputation or analysis service to inspect a destination without browsing to it directly. Check the service’s handling of submitted URLs before using it with private or authenticated links.
• Browser security extensions: Allow only extensions that have a clear business purpose and are managed centrally. An extension that reads page content or browsing activity should be reviewed for permissions, maintenance, and privacy. See Browser Security Extensions for Business.
• DNS filtering: A managed DNS filter can block categories and known dangerous domains across office networks and, when configured for roaming devices, remote workers. Review allowlists carefully; an exception should have an owner, reason, and expiry date. See Best DNS Filtering Tools for Small Business.
• Endpoint protection: Antivirus or endpoint detection and response can identify malicious downloads, scripts, and suspicious behavior after a link is opened. It is a containment layer, not a reason to click untrusted links. Use the Small Business Endpoint Security Checklist to review coverage.
• Safe verification paths: Maintain bookmarks for important services and publish an internal directory for security reporting. This reduces the temptation to use a link from an unsolicited message.

Define who handles each handoff. Employees should know how to report. IT should know how to search for similar messages, reset exposed credentials, revoke sessions, isolate endpoints, and escalate suspected malware or payment fraud. If a link was opened on a managed Windows fleet, the response may involve endpoint telemetry, identity logs, mail traces, and DNS records.

Quality checks

Test the workflow before a real incident exposes gaps. Ask the following questions:

• Can an employee report a suspicious email or message in a few steps?
• Does the reporting route identify the sender, recipients, time, and destination without requiring unsafe interaction?
• Are URL scanners approved, and do employees know not to submit private links or secrets?
• Are DNS filtering, browser protections, and endpoint controls applied to office and remote devices?
• Can administrators quickly identify which users opened a message or visited a destination?
• Is there a separate verification method for payments, password resets, and account changes?
• Are allowlisted domains and browser extensions reviewed rather than left permanently trusted?
• Do employees know what to do after entering a password, downloading a file, or approving an unexpected sign-in?

Run a tabletop exercise using a fictional message, not a live malicious URL. Confirm that the exercise tests reporting, account protection, endpoint isolation, and communication—not just whether someone recognizes a suspicious domain.

When to revisit

Review this process at least when your mail platform, browser, DNS filtering service, endpoint protection, or identity provider changes. Vendor interfaces and reporting paths can move, and a workflow that depends on an outdated button or policy will fail when users need it.

Also revisit the process after a phishing incident, a new scam pattern, a change in remote-work arrangements, or the introduction of QR-code payments and new cloud services. Update examples to reflect the messages your employees actually receive, remove obsolete allowlist entries, and confirm that security extensions and URL-analysis tools still meet your privacy requirements.

As a practical maintenance routine, assign an owner, review the workflow on a regular schedule, test one report-and-response scenario, and record any failed handoff. Keep the employee instruction short: pause, inspect without opening, verify independently, report, and call IT immediately if you clicked or entered information. Pair this link-checking process with your broader Microsoft Defender for Business deployment checklist and ransomware recovery plan so prevention and response remain connected.