iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
There is no visual check that can prove a link is safe. If an unexpected message asks you to sign in, pay, recover an account, or share personal information, don’t use its link: go to the organization’s website using an address you already know, or contact the sender through a separate, trusted channel.
How can you check a link without opening it?
- Pause and check the context. Ask whether you expected the delivery notice, invoice, account alert, or invitation. Surprise, threats, and pressure to act immediately are reasons to stop and verify. The FTC advises, “Don’t click links or download attachments in unexpected messages.” (FTC, April 2025)
- Inspect who sent it. Check the sender’s address and details, not just the display name. A familiar name, logo, or convincing story can be impersonated; Google recommends checking sender information and message authentication. (Google Gmail Help)
- On a computer, hover over the link. Read the destination shown by your browser and compare its domain and spelling with the organization’s genuine address. Google notes, “On a computer, you can hover over any links before you click on them.” (Google Gmail Help) If the destination does not match the link text or looks misspelled, don’t proceed. A match still does not prove the site is safe.
- On a phone, avoid tapping just to inspect. If your messaging app offers a link preview, you can use it to see the destination, but previews are not a safety guarantee. For requests involving money, sign-in, or personal information, open the known official site independently instead.
- Verify through a separate route. Type an address you already trust, use a saved bookmark, or call a number you already know is genuine. If the message appears to come from someone you know, contact them through an established channel. Don’t rely on a phone number or website included in the suspicious message. (FTC guidance)
“https” and a padlock indicate an encrypted connection; they do not establish that the site operator is legitimate. Treat them as connection information, not proof that a message’s link is trustworthy.
What are common phishing and scam link signs?
Phishing messages may pretend to come from a familiar company or person. The FTC and Google identify patterns such as:
- An unexpected invoice, delivery problem, payment issue, or account suspension notice.
- A demand to confirm a password, payment details, or other sensitive information.
- Urgent threats or pressure to act immediately.
- An offer that seems too good to be true, or a generic greeting that does not fit the supposed sender.
- Sender details that do not match, or a link destination that differs from its displayed text or contains a suspicious spelling.
Any one sign deserves caution, but no checklist can authenticate a link. In its April 2025 consumer alert, the FTC said email was the top method scammers used to contact people in 2024; the alert gives no count or percentage for that ranking. (FTC)
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Can you trust a link in a text message or QR code?
Apply the same checks to texts as to email. Don’t tap an unexpected delivery, payment, or account-warning link just because it arrived on your phone. Verify the request through the service’s known website or a contact route you already trust.
A QR code can conceal a spoofed website or a link that leads to malware. Be especially wary when an unexpected code comes with a demand to act quickly. If you scan it, inspect the destination before proceeding; for any request for a login, payment, or personal information, verify independently rather than relying on the QR destination. (FTC guidance on QR-code scams)
Rank #2
- FIDO2 + FIDO U2F certified and supported USB security key
- Secured by NXP semiconductors
- Works in every browser and application without installing any drivers
- Supports desktops, laptops, tablets via USB-A and/or NFC, and supports iOS/Android Phones via NFC
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
What should you do if you clicked a phishing link?
Clicking alone does not show whether anything was stolen or installed. What to do next depends on what happened:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- The page is open, but you entered nothing: Don’t provide information or download anything. Close the page and visit the intended service using a known address if you need to check your account.
- You entered a password: Go directly to the genuine service and change it. If you reused that password elsewhere, change it on those accounts too. Turn on multi-factor authentication where available.
- You shared identity or financial information: Use IdentityTheft.gov for recovery guidance.
- Software downloaded: Update your existing security software and run a scan, as the FTC advises. (FTC)
- You received a phishing message: Report email to reportphishing@apwg.org and the FTC. Forward phishing texts to SPAM (7726) and report them to the FTC, then delete the message. (FTC reporting guidance)
Multi-factor authentication can make it harder for a scammer to access an account using a stolen password. A security key is one possible second factor, depending on the account and device’s compatibility; it does not inspect links or guarantee that a site is safe. (FTC)
Quick Recap
Best Value
- SECURITY KEY FOR ENTERPRISE ACCESS: Supports FIDO2 passkeys and U2F for secure authentication across enterprise IT systems.
- PHISHING-RESISTANT AUTHENTICATION: Enables passwordless login with secure on-device credential storage and PIN-based user verification.
- COMPATIBLE WITH ENTERPRISE SYSTEMS: Works with FIDO2, WebAuthn, and U2F across enterprise, cloud, and modern IT environments.
- DRIVERLESS FIDO2 AUTHENTICATION: FIDO2 works natively with modern browsers and platforms. No drivers required.
- USB AND NFC CONNECTIVITY: Supports authentication via USB-C and NFC. No batteries required.
Rank #4
- FIDO2 SECURITY KEY: A versatile, tamper-evident USB-C authentication device with sensitive presence detection for online security. FIDO 2.0 level 1 and U2F certified
- PASSWORDLESS CONVENIENCE: Replace frustrating passwords with a simple 4-digit PIN for accessing apps and sites. Seamlessly login to web apps and Windows sessions
- BROAD COMPATIBILITY: Works with Windows, Mac, Linux, Apple, iOS, iPhone, Android and USB-C devices. Seamlessly integrates with Identity Providers or Credential Management Systems supporting FIDO2, including Thales, Microsoft, AWS, and Google
- ENHANCED USER ADOPTION: Features a sensitive presence detector on the USB key, providing ease of use and superior security. Certified for U2F and FIDO2, ideal for individuals who want to secure access to their personal online accounts - Microsoft, Google, Twitter, Facebook, GitHub
- THALES: We offer a wide range of FIDO authenticators, providing robust, phishing-resistant MFA that comply with stringent regulations. With almost three decades of experience, Thales is a pioneer in passwordless authentication devices, supported globally by the FIDO Alliance and industry analysts
Rank #3
- FIDO2 + FIDO U2F certified and supported USB security key
- Supports Computers, Laptops, Tablets, and Mobile Devices with a USB-C port and/or NFC
- Works without downloading any drivers. Supported OS: Android, Chrome OS, Windows, MacOS, Linux
- Durable design made to last for a long time with everyday use. Water-resistant (IP67)
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
