Scams & Fraud

A Simple Checklist Before You Share a Link

By Priya Lindqvist / October 17, 2026 / Updated November 8, 2026

Quick answer: Before you tap, forward or post a link, do three things. Find the real domain (the part before the first single slash), check where the link actually goes rather than what it says, and decide who should be able to open it. If a message pushes urgency, money or a login, skip the link and go to the company’s site or app yourself.

Key takeaways

The real website is the domain before the first single slash, not whichever familiar name appears first.
Short links and QR codes hide the destination, so preview or expand them first.
Tracking parameters after a question mark are marketing labels you can usually trim.
“Anyone with the link” means anyone who finds, guesses or is forwarded it can open the file.
If you clicked or shared something bad, work in order: secure, scan, report, warn.

How links get abused

A link is a promise that says “this goes to X,” and promises cost nothing to fake. CISA describes phishing as email or malicious websites posing as a trustworthy organization to collect personal information, with cousins in text messages (smishing) and phone calls (vishing). Its warning signs include a sender address with characters changed or missing, link text that does not match the real destination, lookalike domains, shorteners that hide the destination, and unexpected attachments paired with urgency.

Phishing messages. The FTC lists claims of suspicious activity, a payment problem or an unfamiliar invoice, and notes that legitimate companies do not email or text a link to update payment details.
Lookalike domains and short links. One resembles the real company’s address; the other hides the address entirely.
Malicious QR codes. The FTC says scammers stick their own codes over real ones, such as on parking meters, and send codes by text or email with excuses like a failed package delivery.

The common thread is a link plus a reason to hurry. Distrust the hurry.

Read the address before you trust the link

Find the real domain

Cal State Fullerton’s IT knowledge base gives the clearest rule. The domain is whatever sits after https:// and before the first single slash, including the ending such as .com or .co.uk. Extra pieces on the left are subdomains, and they can be misleading. Their example: in http://www.login.mybank.fake.com/login.php, the real domain is fake.com, not mybank. So read leftward from the first slash and ask, “Does this company actually own that domain?”

Check where the link really goes

On a computer, hover over the link without clicking and the browser shows the real destination at the bottom of the window. If the text says one address and the hover shows another, that is a red flag. If you cannot see the destination, open the app or type the address yourself.

Expand short links safely

The University of Cape Town and Columbus State Community College agree that short links hide the destination, which attackers exploit for phishing pages and malware. Both describe two safe options:

Use the service’s preview. UCT lists TinyURL (insert “preview.” before the domain), Bit.ly (add a “+” at the end) and BL.INK (add “/expand”). These tricks differ by service, so test one on a harmless link first.
Paste it into an expander. UCT names CheckShortURL, GetLinkInfo and WhereGoes; Columbus State names unshorten.it and VirusTotal. They are third-party sites, so never paste a link containing something private.

If you do not know the sender and cannot preview the link, do not click it.

Treat QR codes like links

The FTC’s advice: check the URL before opening it, watch for misspellings or swapped letters, and skip codes from unexpected emails or texts, especially urgent ones. Contact the company through a phone number or website you already know is real.

What previews hide

A tidy card with a headline and picture feels like a safety check, but it is not one. The Open Graph protocol, created at Facebook, exists so whoever builds a page can set the title, image and short description that represent it on social platforms. Cards of that kind are typically page-supplied, so a preview is the page’s own advertisement, not an inspection.

Clean it and lock it: tracking parameters and sharing settings

Strip tracking parameters

Ever copied a link and found a long tail after a question mark? Google’s analytics help shows the pattern: https://www.example.com/?utm_source=summer-mailer&utm_medium=email&utm_campaign=summer-sale. The question mark starts the parameters, each is written name=value, and ampersands separate them. Here utm_source is the referrer, utm_medium the channel and utm_campaign the promotion, so the sender sees which email or ad produced the click.

Firefox’s documentation lists other known tracking parameters, such as fbclid and mkt_tok, and its Query Parameter Stripping removes known ones in Strict mode of Enhanced Tracking Protection.

To clean a link by hand, delete everything from the question mark onward, then test it. Some parameters tell a page what to show, so restore it if the page breaks. Trimming does not make a risky link safe. It only removes the “you came from here” label.

Check “anyone with the link”

Google Drive Help describes three General access settings: Restricted (only people you have added), Anyone with the link (opens without a Google sign-in) and, for work or school accounts, your organization. Roles are Viewer, Commenter and Editor, and editors can by default change permissions and share.

Portland State’s IT office warns that anyone who finds, guesses or is forwarded the link can open the file, and the setting is easy to forget once a project ends. Picture a group-trip spreadsheet full of passport numbers. To review:

Open the file, click Share and read General access. A globe icon on the Share button is Portland State’s hint that the link is public.
Switch to Restricted unless the file really is public, and pick the lowest role that works.
To see who has access, right-click the file and choose More, File information, Details, then Manage access.
To hunt for old public files, use the People filter in Drive search and choose “Anyone with the link” (Stanford), or search owner:me sharedwith:public (Portland State).

If you shared or clicked something bad

It happens to careful people. The order below is drawn from CISA and the FTC:

Clicked a link or opened an attachment? Stop entering anything. Update your security software, run a full scan and remove what it flags (FTC).
Typed a password? Change it and any account that reused it. CISA recommends unique passwords and multi-factor authentication.
Gave out card, bank or Social Security numbers? Contact your bank or card issuer, watch for unexplained charges, and follow the steps at IdentityTheft.gov.
Report it. Forward phishing emails to the Anti-Phishing Working Group (apwg.org lists where to send them), texts to 7726 (SPAM), and report at ReportFraud.ftc.gov. If a work account was involved, tell your IT team.
If you passed the link on, delete the post and tell the recipients.

Your 10-point checklist and a quick table

The checklist

Did I expect this, and do I know the sender?
Does it push urgency, money, a prize or a login? If yes, pause.
Does the hover destination match the link text?
What is the real domain, before the first single slash?
Short link? Preview or expand it first.
QR code? Skip unexpected ones and read the URL first.
Can I reach the company through its app or an address I type?
Have I trimmed the tracking tail and tested the link?
If it is a file, is General access Restricted and the role low?
Do I know my exit plan: change passwords, scan, report?

Link type, risk and what to check

Link type	Main risk	What to check
Email or text claiming to be a bank, delivery or subscription	Phishing for logins or payment details	Sender address, real domain, then use the app or a known number
Shortened link	Hidden destination	Service preview or expander; do you trust the sender?
QR code on a sign or meter	A sticker over the real code	Read the URL before opening; look for misspellings
QR code in an unexpected message	Fake urgency, spoofed site	Do not scan; contact the company directly
Link with a long tracking tail	Clutter and a “came from here” label	Real domain first; trim after the question mark; test
Doc or folder link	Anyone with the link can open it	General access, role, Manage access

Frequently asked questions

Does the padlock mean a link is safe?

It is one check, not a verdict. CISA suggests looking for HTTPS and a closed padlock before sending sensitive information, and separately warns about lookalike domains, so check the domain too.

Is it safe to open a short link just to see where it goes?

Preview or expand it instead. Columbus State’s advice is blunt: if a short link looks suspicious, do not click it.

Will removing tracking parameters make a link safer?

No. It removes marketing labels. Safety comes from the sender and the real domain.

I made a Google document public by mistake. Now what?

Change General access to Restricted and review Manage access. That closes the door going forward, but anyone who already copied the contents keeps their copy. If it held passwords, change them.

Before you decide

You do not need all ten points on every link. Start with two habits: read the domain, and set shared files to Restricted. If something still feels off, ask the sender through a different channel. Nobody is embarrassed by a “did you really send this?” text.