Inspect an email link on a phone or PC without trusting its label
Read the actual hostname, treat shortened links as incomplete evidence and verify the request outside the email.
In brief
The text on an email button can say one thing while its destination is somewhere else. A desktop hover or phone link preview can reveal the address, but the address still needs interpretation.
This check is useful before an unexpected invoice, password reset or shared-document invitation asks you to authenticate.
Read the address in the right place
In a URL such as https://accounts.example.com/help, the hostname is accounts.example.com. The words after the first path slash are not the hosting identity. For a lookalike involving a real brand, compare against an address you already know, rather than accepting the most familiar word you see.
Do not turn inspection into exposure
Avoid posting password-reset or document links into a public checker: they may carry a private access token. If the preview is shortened, obscured or unexpected, it has not established safety. Use the service directly or confirm with the sender through an existing contact channel.
Treat requested actions as part of the risk
An ordinary document should not need you to disable protection or run a command to read it. A notification of a payment change deserves independent verification before you act. Good spelling, a familiar sender display name and an encrypted connection do not replace that check.
Before you act
Previews and shortened links may not reveal the final destination. Mobile long-press behaviour differs; use a preview or copy action, not a gesture that opens the link immediately.
What to do next
- Preview the link using your mail app’s available non-opening action.
- Read the hostname and check for a misleading subdomain or lookalike spelling.
- Open the service independently and confirm the request rather than logging in through the email.
