EMAIL LINKS: THINK BEFORE YOU CLICK!

We all get dozens, if not hundreds, of emails every day. Many of them contain links. How do we know if those links are safe to click? With cybercriminals getting cleverer, it can be harder to differentiate between safe and malicious links. Watch out for three main lures: unexpected links, suspicious domains, and tricky links.

Were you expecting a link in a message from a company you do business with, or from a coworker, friend, or family member? If not, don’t click the link, even if the sender appears to be valid. The sender’s email could have been hacked and used to send you a malicious link. Or, the attacker could have faked the sender field to make it look legitimate.

If the sender is someone you know, verify with them that the link is legitimate. If it’s from a company you do business with, but you aren’t expecting the link, type the company’s URL into a browser and access your account to see if there are issues you need to address. Don’t click the link.

Pay attention to the link’s domain — the website the link is taking you to. Remember that when you are evaluating a domain, you look at it from right to left (yes, backward!), and that the actual domain name comes between the first forward slash (/) after the protocol and the first dot (.).

In Figure 1, marigoldbank.com is the domain name, and it’s the website you would go to if you clicked the link. The useraccount part of the link is called the subdomain.

Now that you know how to find the real domain name, be on the lookout for the following warning signs that indicate a malicious link.

Figure 1

It can be hard to tell where a link is going to take you just by looking at the link itself. Sometimes the link text is just a word or phrase: “We noticed suspicious activity on your Marigold Bank account. Log in to your account to verify the activity.”

Other times, the link is buried in a graphic or a button that takes you to the site, like this logo for Marigold Bank.

Even if the link shows the full address (for example, https://www.marigoldbank.com), can you really be sure that link is going to take you where it says it will? No.

A favorite phishing trick is to disguise a malicious link behind a legitimate-looking link, in the hopes that you’ll click on it. Always hover your mouse over the link text or button to see where it’s really going. Remember to focus on the actual domain name.

Only click links if you’re expecting them

Check the domain name carefully

Hover over a link to see where it’s really going

If you trust the name of the organization who sent the email, but the link is unexpected, type the URL you know into your browser or use your bookmark — don’t click the link