The tricks, one by one
Scammers always use the same handful of tricks. Here they are, each with an example.
Fake links
The fake beginning
https://instagram.com.secure-check.info/login
The brand is at the start, but the part that counts is at the end: secure-check.info. Anyone can write anything before it.
The hidden digit
https://www.g1thub.com/secure/github
A digit hides in the name: “g1thub.com” is not GitHub.
The glued letters
https://zoorn.us/verify
Letters glued together imitate another one: “rn” looks like “m”, “vv” like “w”, “cl” like “d”.
The foreign letter
https://microsоft.com/verify
One letter comes from another alphabet (Cyrillic). It looks identical, but it is a completely different address.
The added word
https://billing-ebay.info/verify
Adding a word to a brand (-secure, -login, -support…) creates a different domain that anyone can buy.
The wrong ending
https://www.coinbase.click/verify
Right name, wrong ending: the usual address of Coinbase is coinbase.com, not coinbase.click.
The @ trick
https://adobe.com@safe-access.online/secure/adobe
Everything before “@” is ignored: this link really goes to safe-access.online.
The free hosting
https://whatsapp-billing.netlify.app/
This page lives on a free hosting service, where anyone can get their own address in two minutes. So the whole name counts here: whatsapp-billing.netlify.app.
The address in numbers
http://126.24.105.28/google/login
A number address instead of a name: real companies almost never send you there.
The brand in the path
https://client-portal.online/www.paypal.com/login
The brand appears after the “/”, in the path: it decides nothing. You really go to client-portal.online.
Disguised attachments
The double extension
bank_statement.png.js
Double extension: it pretends to be .png, but it really is .js, a program that runs when opened.
The hidden spaces
payment_receipt.xlsx ␣×40 .exe
Spaces push the real extension out of sight: it is actually a .exe program.
The program you did not expect
setup.exe
Honest name, but it is a program (.exe): only open it if you were expecting one.
I clicked. What now?
- Only clicked? Close the page. If you typed nothing and opened no file, the risk is low.
- Typed a password? Change it right away on the official site, and everywhere you use the same one.
- Gave card or bank details? Call your bank now, using the number printed on your card.
- Opened a file? Disconnect from the internet, run an antivirus scan and ask someone you trust for help.
- A child? Tell an adult. Nobody will be angry: it happens to everyone.