To click or not to click? Why link safety matters!

source from this super helpful article

We often recommend that people think before they click on links; or click with care – why is that?

One of the main pieces of advice we give people for being safe online is to be wary of hyperlinks – dont click on links in unexpected emails or messages from people or organisations you dont know.

This is because emails with malicious links are still one of the most effective delivery methods* for many types of online scams and threats, like malware and ransomware.

Often, it is possible to hover over a link (in an email or on social media, instant messages, other webpages, or other means) to see the actual web address it will take you to (usually shown at the bottom of the browser window).

Then, if you do not recognise or trust the address, you can try searching for key terms or the destination website. This way you can find the article, video, or webpage without directly clicking on the suspicious link.

But what happens when the URL has been shortened?

Link shortening is often used by social media services which limit the number of words or characters you can use per post. Some URLs can be 100 characters long – so URL shortening is a very attractive service.

The trouble is that link shortening is also attractive to scammers because it can be difficult to know where short links will take you.

Just like email and SMS, social message-based phishing messages attempt to fool you into taking action. If compromised, not only will criminals have access to your private messages and information, your social media account can also be used to further spam messages to your contacts, circumventing many of the platforms own protection mechanisms.

Your account can then be used to spread malware and other nasties online.

An expand link facility allows you to enter a shortened URL to see where it leads. It shows you the original, expanded URL that has been shortened.

Some of the services to unshorten URLs also check if the original link is available through search engines and other sites, which may indicate if the hidden link is safe or not.

(If you ever want to see where a bit.ly link redirects, you can add a plus symbol to the end of the link:
For example: https://bit.ly/1su5uoX is a bitly link but if you add a plus sign to the end of it, like this: https://bit.ly/1su5uoX+ , it will show you where the link redirects.)

Be careful clicking shortened links, particularly those that use shortening services outside of the platforms own built-in service (for example, Twitters t.co service, Googles goo.gl service, and Yahoos y.ahoo.it service.)

Evaluate the message, its context and its sender as part of your decision to click. If a message is ‘out of character for a sender, you should treat it with suspicion.

There are plug-ins available for most internet browsers that can display the original URL before you click. Look in your browsers security settings or the vendors official help and support site.

Be cautious about messages from anyone you do not know or trust.

Never give out your account username or password. Reputable organisations including Twitter, will not request your personal information via a Tweet.

If you click a link, always check the website you are on before you interact with it, provide any information or download software.