The messages scammers send
Most scam links arrive through SMS, chat apps such as Zalo, Messenger and Telegram, or social media comments. They impersonate banks warning of a locked account, delivery companies asking for a small fee, utility or tax offices, police or court officers, and friends whose accounts have been taken over.
The message almost always creates pressure: your account will be suspended today, a parcel will be returned, you must update your identity, or a fine must be paid. The goal is to make you tap before you think.
Some scams skip the website entirely and ask you to install an app or an APK file that pretends to be an official service. Those apps can read messages, including one-time passwords, so they are even more dangerous than a fake page.
- Fake bank alerts about locked accounts or “biometric updates”.
- Fake delivery fees or address confirmation.
- Fake police, court or tax notices.
- Prize, refund and part-time job offers.
- Messages from a friend asking you to vote, lend money or click a link.
Read the real domain name
The domain is the part just before the first single slash, and the most important piece is the name directly before the ending such as .com, .vn or .com.vn. In https://secure-bank.example.top/login the site belongs to example.top, not to a bank, no matter what words appear in front.
Scammers use look-alike tricks: extra words, hyphens, swapped letters, unusual endings such as .top, .xyz or .shop, and subdomains that put a brand name on the left. Short links hide the destination completely, so expand them with a link preview service or simply do not open them.
The safest habit is to never follow a link in an unexpected message. Open your banking app or type the official address yourself instead.
https://www.examplebank.com.vn/ -> examplebank.com.vn (official)
https://examplebank.com.vn.verify-id.top -> verify-id.top (scam)
https://examp1ebank-vn.com/ -> examp1ebank-vn.com (look-alike)Check WHOIS age and DNS records
A WHOIS lookup shows when a domain was registered, which registrar manages it and when it expires. Banks and large companies usually own their domains for many years. A domain created a few days ago that claims to be a bank is a strong warning sign.
A DNS lookup shows where the domain points. It is less conclusive, but a supposed national bank hosted on a cheap overseas server, or a domain with no mail records at all, adds to the picture.
Privacy-protected WHOIS records are normal and not suspicious on their own; focus on the creation date and whether the name matches the organisation.
Why the padlock does not mean safe
HTTPS only means the connection between your browser and that website is encrypted. Free certificates are issued automatically to anyone who controls a domain, including scammers, so almost every phishing page now shows a padlock.
The padlock tells you that nobody on the network can read what you type; it does not tell you who receives it. A perfectly encrypted connection to a scam site still hands your password to the scammer.
Judge a site by its domain name and by how you got there, not by the padlock.
What to do if you already clicked
Simply opening a page on an up-to-date phone rarely infects it. The danger starts when you type passwords, card numbers or one-time codes, or install an app. Act quickly if you did any of these.
Contact your bank through the hotline on the back of your card or in the official app, change passwords from a device you trust, and turn on two-factor authentication. Remove any app you installed from the link and check which apps have accessibility or SMS permissions.
- Stop entering information and close the page.
- Call your bank on its official number to lock cards or accounts.
- Change the password and sign out other sessions.
- Uninstall unknown apps and revoke accessibility permissions.
- Report the message to your carrier or the platform.
Common questions
Does a link checker guarantee safety? No. Reputation services only know about pages already reported, and new scam domains appear every day.
Will a bank ever send a link asking me to log in? Most banks say they never do this by SMS or chat. Treat any such message as suspicious.
Is it safe to tap a link from a friend? Not automatically. Accounts are often stolen and used to send links, so confirm with a phone call first.