7 Signs a Link Is Fake Before You Click It

Online Scams: How to Spot Fake Links and Protect Yourself from Internet Fraud

You receive a WhatsApp message saying your parcel cannot be delivered. Another message claims your bank account will be suspended unless you verify your details immediately. Then, an SMS arrives informing you that you have won a shopping voucher, a cash prize, or some other reward you never entered a contest to win.

Every message comes with a link.

What do you do?

For many people, the answer is simple. They click first and think later.

That is exactly what scammers are counting on.

Online scams have become increasingly convincing. Fraudsters impersonate banks, government agencies, delivery companies, online shopping platforms, and even people we know. Their messages may look professional, their logos may appear genuine, and their websites may look almost identical to the real thing.

But here is the good news: you do not need to be a computer expert to recognise many fake links. A little patience and some common sense can help you avoid becoming the next victim of an online scam.

Here are seven warning signs to look for before clicking any suspicious link.

1. The Website Address Looks Strange

The first thing you should check is the website address, also known as the URL.

Scammers often create fake website addresses that look similar to legitimate ones. They may change a letter, add an extra word, or use a slightly different domain name to fool unsuspecting visitors.

For example, a fraudulent address might use maybank-security.example instead of an official Maybank domain. The example is illustrative, but the trick is real: scammers rely on people recognising the brand name without checking the actual address.

Look carefully for:

• Misspelled brand names.
• Extra words such as "verify", "secure", or "account-update".
• Unusual combinations of letters and numbers.
• Unexpected domain endings.
• Shortened links that hide the destination.

Do not assume a website is genuine just because the company name appears somewhere in the address.

When in doubt, open the company's official app or type its known website address into your browser yourself.

A few seconds of checking can save you a lot of trouble.

2. The Message Tries to Scare You into Acting Immediately

"Your bank account will be blocked in 30 minutes!"

"Your parcel will be returned today!"

"Your account has been compromised. Click here immediately!"

Sound familiar?

Scammers know that people make poor decisions when they panic. Instead of giving you time to think, they create a sense of urgency so that you react emotionally.

This is a common technique in phishing scams, where criminals attempt to trick people into revealing passwords, banking information, or other sensitive details.

Legitimate organisations may sometimes send urgent notifications, so urgency alone does not prove a message is fraudulent. However, a threatening message that demands immediate action through an unfamiliar link should raise suspicion.

Stop for a moment. Ask yourself why you are being pressured to act so quickly.

If the message claims to come from your bank, check through its official app or contact the bank using a verified phone number.

Remember, scammers want you to panic. Your job is to disappoint them.

3. The Link Arrives from an Unexpected Sender

You receive a message from an unknown number claiming to represent Pos Malaysia. Or someone sends you a link about an unpaid toll, a traffic summons, or a parcel waiting for delivery.

Perhaps the message arrives from a number that looks local. Maybe the sender even knows your name.

Do not automatically trust it.

Scammers can send messages using unfamiliar numbers, compromised accounts, or misleading sender identities. Even a message that appears to come from someone you know can be dangerous if their account has been taken over.

Be particularly cautious when:

• An unknown sender asks you to click a link.
• A friend sends an unexpected link with no explanation.
• Someone claims to represent a bank or government agency but directs you to an unfamiliar website.
• You receive a notification about a transaction or delivery you do not recognise.

If a friend sends you a suspicious link, contact them through another channel and ask whether they actually sent it.

Do not let familiarity replace verification.

4. The Link Uses an Unfamiliar or Shortened URL

You have probably seen shortened links that begin with services such as bit.ly.

There is nothing inherently wrong with shortened URLs. Businesses, marketers, and ordinary users rely on them for legitimate purposes.

The problem is that a shortened link conceals the full destination.

You may think you are opening a delivery tracking page, but the link could lead to a fake login page, a fraudulent payment form, or a malicious website.

The same caution applies to links embedded in QR codes. A QR code does not become trustworthy simply because it looks professional.

If you do not recognise the destination, avoid opening the link until you can verify it. Use a reputable link-preview or security-checking service where appropriate, but remember that no checking tool can guarantee that a link is safe.

An even safer option is to visit the organisation's official website independently and find the information there.

If a message claims you owe a small delivery fee, for example, check your order through the seller's official platform instead of paying through the message.

That small fee could be bait for a much bigger problem.

5. The Website Requests Too Much Personal Information

Imagine clicking a link to track a parcel. Instead of showing delivery information, the website asks for your full name, identity card number, bank account details, card security code, online banking password, and one-time password.

Why would a delivery company need all that information just to deliver a parcel?

It should immediately make you suspicious.

Fake websites often imitate legitimate services to steal personal and financial information. Once criminals obtain these details, they may attempt unauthorised transactions, account takeovers, or identity fraud.

Never provide your online banking password, PIN, or TAC/OTP in response to an unexpected message or suspicious website. Never approve a transaction or authentication request you did not initiate.

Also remember that HTTPS and the padlock symbol only indicate that a connection is encrypted. They do not prove that the website itself is legitimate.

Scammers can obtain security certificates for fraudulent websites too.

The rule is simple: before entering sensitive information, make sure you are dealing with the genuine organisation and that the information requested makes sense for the service.

6. The Website Looks Unprofessional or Contains Strange Errors

Some fake websites are sophisticated. Others look as though someone created them during a lunch break.

You might notice poor spelling, awkward grammar, blurry logos, inconsistent colours, broken buttons, or strange formatting.

A Malaysian government notice might suddenly contain unusual English phrases. A bank website might display inconsistent company names. A supposed customer service page might have no meaningful contact details.

These are warning signs worth investigating.

However, do not rely on spelling mistakes alone. Scammers can copy genuine websites and produce convincing messages with excellent grammar.

Likewise, legitimate small businesses sometimes have poorly designed websites.

Look at the overall picture. Does the address match the organisation? Does the website behave as expected? Is it asking for information that seems unnecessary? Does the message match anything you can verify independently?

One suspicious detail may have an innocent explanation. Several suspicious details together should make you walk away.

7. You Are Promised Something That Sounds Too Good to Be True

Congratulations! You have won RM10,000.

Your name has been selected for a lucky draw you never entered.

A stranger promises you extraordinary investment returns if you register through a special link.

Or perhaps you are offered a huge discount on a popular product, but you must pay immediately through an unfamiliar website.

These are classic ingredients of online fraud.

Scammers use greed, curiosity, excitement, and the fear of missing out to persuade people to act without checking the facts.

Sometimes, the offer is designed to steal your payment details. In other cases, it may be the first step in a longer scam involving fake investment platforms, advance-fee requests, or identity theft.

Before accepting an unexpected reward, ask yourself three simple questions:

• Did I actually enter this competition?
• Can I verify the offer through the company's official channels?
• Why must I provide money or sensitive information to receive something I supposedly won?

If the explanation does not make sense, do not proceed.

Free money that requires your banking password is not free money. It is a warning sign.

What Should You Do If You Receive a Suspicious Link?

You do not need to investigate every suspicious message. Sometimes, the safest decision is simply to ignore, block, and report it.

Here is a practical checklist:

1. Do not click immediately. Pause and examine the message.
2. Verify the sender. Contact the organisation using its official app, website, or verified phone number.
3. Check the URL carefully. Look for misspellings, unusual domains, and misleading subdomains.
4. Never share authentication details. Do not disclose passwords, PINs, or OTPs.
5. Report suspicious messages. Use the reporting tools provided by the relevant platform, bank, or authority.
6. If you have already entered banking information or authorised a suspicious transaction, act quickly. Contact your bank through its official emergency channel. In Malaysia, call the National Scam Response Centre at 997 for assistance with suspected financial scams, subject to current operating arrangements. You can also report cyber incidents to CyberSecurity Malaysia through its official channels.

If you have clicked a link but have not entered any information, do not panic. Close the page, avoid downloading anything, and check your device if you suspect a file was installed or your security was compromised. If you entered a password, change it using the genuine website or app, especially if you reused that password elsewhere.

Speed matters when financial accounts may be at risk.

Final Thoughts: Think Before You Click

The internet has made our lives easier. We can pay bills, shop online, manage our banking, and communicate with almost anyone from a smartphone.

Unfortunately, the same convenience gives scammers more opportunities to reach us.

The biggest mistake is assuming that only careless or inexperienced people fall for online scams. Intelligent, educated, and cautious people can also be deceived, especially when criminals exploit fear, trust, or urgency.

You do not need to become paranoid about every message you receive. You simply need to develop better habits.

Check the address. Question unexpected requests. Verify offers independently. Never surrender sensitive information just because a message tells you to act quickly.

And remember this simple rule:

A link takes only a second to click, but recovering from an online scam can take months — or even longer.

Next time a suspicious message appears on your phone, jangan gopoh. Take a breath, check the facts, and think before you click.

Because when it comes to online scams, a little suspicion can save you a lot of money.