How to read a web address

Almost every fake website gives itself away in the address bar, and almost nobody looks, because nobody was ever taught what to look at. It is one rule.

Find the real domain

Take everything after https:// up to the first single slash. Inside that, the real site is the last two parts before the first slash.

• https://www.barclays.co.uk/personal/login — the domain is barclays.co.uk. Genuine.
• https://barclays.co.uk.secure-verify.net/login — the domain is secure-verify.net. The bank's

name is just decoration someone typed.

• https://accounts.google.com/signin — google.com. Genuine.
• https://google.com-verify.info/signin — com-verify.info. Not Google.

The trick is nearly always the same: put the real brand somewhere in the address where it does not control anything. Before a dot. After a hyphen. In the path. All decoration.

UK addresses have three parts rather than two (barclays.co.uk, gov.uk, nhs.uk), so read the whole ending.

The tricks worth knowing

Hyphens. hmrc-refunds.com is not HMRC. A real organisation owns its name; it does not need to bolt a word on with a hyphen.

Lookalike letters. paypa1.com with a one. rnicrosoft.com with r-n instead of m. These work at a glance and fall apart when you actually read them.

Subdomains. login.microsoft.support-team.co is support-team.co. Anything before the domain can be invented freely by whoever owns it.

Extra endings. .com.co, .co.uk.com, .net.co — all designed to be misread as the ending you expected.

What the padlock means, and does not

The padlock means the connection is encrypted. That is all. Scammers get certificates in seconds and for free, so the padlock tells you nobody is reading the traffic, not that the site is honest. Almost every phishing page has one.

Where links hide

The visible text of a link has nothing to do with where it goes. www.yourbank.com can point anywhere. On a computer, hover and read the status bar. On a phone, press and hold until the address appears. In an email, be especially careful: the display text is written by the sender.

The habit

Before you type anything into a page that asks for a password or a payment, look at the address bar and find the real domain. It takes about three seconds and it stops the large majority of this.

If you are unsure, our link checker does the reading for you and explains what it found, without ever opening the page.