How to Spot a Identity-theft link in Three Seconds

Why links, and not viruses

Modern phones and laptops are genuinely hard to infect without help. So the economics moved: rather than break the device, attackers ask the person. A link in a text, an email or a marketplace chat costs nothing to send and works on every operating system at once.

That is why the same four or five stories keep circulating — a held parcel, an unexpected refund, a suspicious bank login, an overpaid marketplace buyer, a prize. Each one manufactures a small deadline so you act before you think.

The identity does not need to fool you forever. It needs to fool you for the eight seconds between the notification and the password field.

The four tells

First, the domain. Read the part immediately before the first single slash and nothing else. `royalmail.delivery-update.co` is not Royal Mail; the real name always sits at the end, not the beginning.

Second, the urgency. Genuine organisations rarely give you two hours to avoid losing something. Identity theft almost always do, because pressure suppresses checking.

Third, the payment method. Gift cards, crypto, bank transfers to a 'safe account' and remote-access software are not how any real institution resolves a problem.

Fourth, the channel mismatch. Your bank does not begin a conversation about fraud in a text message with a link. Your tax office does not text about refunds at all.

The habit that beats all of them

Never act from the link. If the message might be real, close it and open the organisation's own app or type the address you already know. If there is a genuine problem, it will be waiting for you there.

This single habit defeats every variant of the identity at once, including ones nobody has invented yet — which is why we teach it before we mention any software.

Blocking helps as a safety net for the moment you are tired, distracted or holding a toddler. It should not be the only thing standing between you and a fake login page.