Common Online Scams and How to Avoid Them
By cryptoke, developer and editor at SafeLinkWrite. Reviewed for technical accuracy.
Every online scam that reaches a target does so through a link. A bank alert, a "friend" request, a job offer, a marketplace buyer, a crypto giveaway — the pattern is identical: something asks you to click before you have time to think. According to the FBI's Internet Crime Report, US victims reported over USD 12.5 billion in losses in 2023, and phishing remains the single most reported crime type. That figure is not a consequence of bad software. It is a consequence of decisions made inside a five-second window next to a clickable URL.
This guide looks at link-based scams specifically: how deceptive URLs are built, how to inspect one before clicking, and how to tell the difference between a legitimate intermediate page (such as a safelink or disclosure wrapper) and a hostile one.
Why Links Are the Delivery Mechanism
A scam message is only as effective as the click it produces. That means attackers spend most of their effort on the link itself — not the message. The link has to survive three tests before a victim clicks it:
- Looks familiar. Display text and subdomain are chosen to match a brand.
- Feels urgent. The message frames the click as the only way to prevent a loss.
- Avoids inspection. URL shortening, lookalike characters, or an intermediate page block the reader from seeing the destination.
Understanding those three tests is the operating principle behind every link-based scam. The categories that follow are variations on the same tactic.
Technical Breakdown: Common Deceptive Link Patterns
| Pattern | Mechanism | Technical tell |
|---|---|---|
| Typosquatting | Domain registered to look like a real brand: paypa1.com, linkedln.com, micros0ft.com. |
WHOIS shows registration within weeks or months, not years. |
| Subdomain deception | Real domain appears as a subdomain: bank-login.attacker.com instead of bank.com. |
Read the URL right-to-left: the domain is whatever is left of the first single slash. |
| Homograph attack | Cyrillic or Greek characters replace Latin ones. аpple.com (Cyrillic "а") is not the same as apple.com. |
Copied-pasted URL renders correctly; typed or inspected characters reveal the mismatch. |
| URL shortener obfuscation | Long or suspicious URL masked behind bit.ly or t.co. |
Shorteners often expose a preview endpoint: adding + or ?info reveals the destination. |
| Meta-refresh redirect | Intermediate page shows a notice then redirects without user interaction. | Checking the source reveals a meta http-equiv="refresh" tag that fires before the visitor can verify. |
| Fake safelink page | Intermediate page mimics a trustworthy safelink but hides the destination until the visitor clicks again. | Legitimate safelinks display the destination URL. Fake ones do not. |
| Query-parameter abuse | URL like trusted.com/redirect?url=attacker.com uses the trusted domain to launder the destination. |
Anything after ? is argument data — not the domain. The domain is trusted.com, but the redirect target is not. |
Every one of these is applied in at least one of the scam formats people encounter daily — phishing, job offers, marketplace requests, crypto giveaways, and fake technical support.
Example: Inspecting a Suspicious Link in Ten Seconds
Consider this message arriving by SMS:
ALERT: Unusual activity on your account.
Verify now: https://bca-secure.attacker-redirect.com/r?u=bca-login&t=10Reading the URL from right to left, character by character:
- Protocol:
https://. This proves nothing — over 90% of phishing sites use HTTPS. - Subdomain:
bca-secure. Designed to trigger brand recognition, not a real BCA property. - Actual domain:
attacker-redirect.com. This is who owns the link. The entire scam succeeds or fails on whether you notice this segment. - Path:
/r. Non-descriptive, likely a redirect handler. - Query:
u=bca-login&t=10. The parameters tell the server which fake page to serve and when to trigger the redirect.
If you had clicked, the intermediate page would redirect you after 10 seconds to a lookalike login form. What you typed there would not go to BCA.
Myths vs Facts About Suspicious Links
| Myth | Fact |
|---|---|
| "The padlock icon means the link is safe." | The padlock only means the connection is encrypted. Phishing sites use HTTPS too. |
| "If the brand name appears in the URL, it's official." | The brand can appear as a subdomain or a query parameter. Only the segment immediately left of the first single slash is the real domain. |
| "Clicking a bad link infects your device." | Most malicious links lead to credential-harvesting pages. The damage comes from what you type there, not from the click itself. |
| "Shortened links are always malicious." | Legitimate shorteners exist. The problem is opacity — you cannot see where a shortened URL goes without expanding it. |
| "Safelinks hide the destination on purpose." | Well-built safelinks show the destination so the reader can verify before continuing. A safelink that hides the target is not a safelink. |
| "You can trust any link sent by a contact." | Contact accounts get compromised. If a link arrives unexpectedly from anyone, verify through a separate channel before clicking. |
Five Steps to Handle Any Suspicious Link
- Read the URL right-to-left. Identify the actual domain — the segment before the first single slash. Ignore subdomains and query parameters.
- Refuse to click first, verify second. If the message promises urgency, assume manufactured urgency. Open the service directly through its official app or by typing the domain yourself.
- Expand shortened links before opening. Use a URL preview service or append
+to the shortener URL to view the destination without loading it. - Check domain age when in doubt. A WHOIS lookup on any free service reveals registration date. Brands have old domains; phishing domains rarely do.
- Report and block. Report phishing URLs to your email provider, browser, or national reporting portal. Blocking the sender prevents a second attempt.
Conclusion
Link-based scams succeed because they compress the decision window: get the reader to click before they inspect. The countermeasure is equally compressed — a ten-second read of the URL from right to left, a rule against clicking unverified links, and the habit of reaching the destination by a channel the sender does not control. Every category of online scam you will encounter arrives through the same delivery mechanism. Treat the link, not the message, as the thing to scrutinize.