Become a URL detective: how to spot a fake website

You get an email that looks official, telling you to log in to your bank account or verify a shipping address. You click the link, and you’re taken to a website that looks exactly like the real one. Everything seems fine, but something feels a little off. This is a classic phishing attack, and the key to spotting it often lies in the website’s address—the URL.

Scammers are masters of creating fake websites that look identical to a trusted one. But they can’t fake the URL. Knowing how to read a URL is your superpower in the fight against these scams.

Anatomy of a URL

Let’s break down a URL into its parts so you know exactly what to look for. A typical URL looks something like this:

https://www.google.com/search/tools

• Protocol (https://): This is the first part. It tells your browser how to talk to the website. HTTPS stands for Hypertext Transfer Protocol Secure. The “S” is crucial! It means the website is using a secure, encrypted connection to protect your data. Always look for the S and the lock icon in your browser’s address bar before you enter any personal information.
• Domain (www.google.com): This is the heart of the URL and the most important part to pay attention to. It identifies the website itself. The domain is the part that comes after the protocol and before the first forward slash (/).
• Directories and Pages (/search/tools): Everything that comes after the first forward slash is just a folder and a page on the website. This part can be easily faked and manipulated by scammers.

The Domain Is Everything

When a scammer creates a fake website, they have to use a fake domain. This is where you can catch them. They might try to trick you with clever variations that look very similar to the real domain.

For example, a scammer might try to impersonate your bank.

• Real Bank URL: https://www.yourbank.com
• Fake URLs:
  • https://www.yourbank-login.com (Adding extra words)
  • https://wwwyourbank.com (Removing a period)
  • https://www.yourbank.co/m (Using a different domain ending, then a forward slash and a letter)

Do you see the differences? Even though they might look similar, these are completely different websites. Always check the domain carefully. A real website’s domain will never have extra words or a different address after the . and before the /.

Your Action Plan

So, what should you do when you get a suspicious email with a link?

1. Don’t Click It! Resist the urge to click any link in an email or text message, especially if it’s unexpected.
2. Look Closely: Hover your mouse over the link to see the real URL without clicking.
3. Type it Yourself: When in doubt, open a new browser tab and manually type in the official website address. For example, type www.google.com directly into your address bar, then log in. This is the safest way to ensure you’re on the legitimate site.

By training your eyes to be a URL detective, you can easily spot fake websites and protect yourself from phishing scams.