How to Check If a Link Is Safe Before Your Parent Clicks It

Your mom gets a text: "Your package couldn't be delivered. Click here to reschedule." The link looks plausible — maybe it even has "USPS" somewhere in the URL. She clicks it. Thirty seconds later, her name, address, and phone number are in a scammer's database.

This scenario plays out millions of times a year. The good news is that checking a link before clicking takes about ten seconds and requires nothing more than free tools that work on any phone or computer. This guide gives you the exact tools and a simple decision rule you can teach your parents — and use yourself whenever something feels off.

Why Links Are the Primary Attack Vector

Scammers don't need to hack anything. They just need one person to click a link. That link might:

• Take your parent to a fake login page that captures their username and password
• Trigger a malware download that installs software giving scammers remote access to the device
• Load a fake "Your account has been suspended" page designed to capture credit card numbers
• Start a fake tech support popup that scares seniors into calling a fraudulent number

The URLs used in these attacks are designed to look trustworthy. Scammers register domains like usps-delivery-rescheduling.com or amazon-account-verify.net specifically to fool people at a glance. Older adults who may not scrutinize the address bar closely are a prime target.

The 10-Second Rule: Pause Before You Click

Before any link gets clicked, apply this simple check:

Did this message arrive unexpectedly? Scammers rely on surprise. A legitimate package delivery service doesn't suddenly text you with a link out of nowhere — you would have received tracking information through an established channel when you placed the order.

If the answer is yes — unexpected message, unexpected link — that alone is reason to verify before clicking.

Free Tools to Check Any Link

VirusTotal (Best All-Around)

Website: virustotal.com

VirusTotal scans a URL against more than 90 security databases simultaneously and returns results in seconds. It is free, requires no account, and works on any device.

How to use it:

1. Copy the link without clicking it (long-press on mobile to copy, or right-click on desktop)
2. Go to virustotal.com in a separate browser tab
3. Click the URL tab
4. Paste the link and press Enter
5. A result showing all green checks means the major security vendors have not flagged it
6. Any red flags mean do not click

This is the tool to bookmark and use whenever a link feels suspicious.

Google Safe Browsing Transparency Report

Website: transparencyreport.google.com/safe-browsing/search

Google's Safe Browsing database is the same one powering Chrome's built-in warnings. You can query it directly. Paste the URL and Google tells you whether it has been flagged for phishing or malware.

This is most useful for websites your parent may want to visit rather than a one-time link in a text message.

URLScan.io (Detailed Analysis)

Website: urlscan.io

URLScan actually loads the website in an isolated browser, takes a screenshot, and shows you what the page looks like — without you ever visiting it. This is useful when you need to see what a suspicious site is actually trying to do. You can see whether it's imitating a well-known brand, asking for login credentials, or displaying a fake security warning.

PhishTank

Website: phishtank.org

PhishTank is a community-reported database of known phishing sites. If a scam site has been reported before, it will appear here. Less useful for brand-new scam domains but worth a quick check.

How to Spot a Suspicious URL Without Any Tools

Teach your parents these visual checks. They take two seconds and catch most unsophisticated scams.

Check the Domain Name Carefully

The "real" part of a URL is the domain immediately before the first single slash. Everything before that is a subdomain, and everything after is a path.

Examples:

• amazon.com/your-account — legitimate (amazon.com is the domain)
• amazon-account-verify.net/login — fake (the domain is amazon-account-verify.net, not amazon.com)
• account.amazon.com.phishing-site.com/verify — fake (the domain is phishing-site.com, not amazon.com)

The scammer's goal is to get "amazon" or "usps" or "irs" somewhere in the URL so it looks official at a glance. Teach your parent to look at what comes right before .com (or .net, .org, .gov).

Look for HTTPS — But Don't Stop There

The padlock icon in the browser bar means the connection is encrypted. It does not mean the site is legitimate. Scam sites use HTTPS too. A padlock is the minimum bar, not a safety certificate.

Watch for Typosquatting

Scammers register domains with deliberate misspellings: arnazon.com, rn instead of m, paypa1.com with a number one instead of the letter L. These are harder to catch at a glance, which is exactly why the tools above matter.

Shortened Links Are Always Unknown Quantities

Links from services like bit.ly, tinyurl.com, or t.co hide the actual destination. Treat any shortened link from an unexpected source as a red flag. Use a link expander (search "expand short URL" for free tools) or just don't click it.

What to Do When You're Not Sure

Set up this simple rule with your parent:

"If you didn't expect it, check it first."

The workflow:

1. Receive a text or email with a link
2. Was this expected? If no, copy the link without clicking
3. Paste it into VirusTotal before clicking
4. Green across the board? Proceed with caution
5. Any red flags? Delete the message and report it

For parents who are less tech-comfortable, an even simpler rule works: never click links in text messages or emails for banking, delivery, or government sites. Instead, go directly to the official website by typing the address into the browser manually.

Setting Up Chrome's Built-In Protection

If your parent uses Google Chrome, make sure Enhanced Safe Browsing is enabled. This checks URLs against Google's database in real time.

Path: Chrome menu (three dots) > Settings > Privacy and security > Security > Select "Enhanced protection"

This means Chrome itself will flag many phishing attempts before the page even loads — an automatic safety net that requires no action from your parent in the moment.

For iPhone Users: Message Filtering

iPhones can filter messages from unknown senders into a separate folder, reducing the chance a scam text gets noticed and acted on.

Path: Settings > Messages > Toggle "Filter Unknown Senders" to ON

Unknown senders get moved to a separate tab in the Messages app, making it less likely your parent will see — and act on — a scam text before thinking twice.

A Note on Email Links

The same rules apply to email links, with one additional technique: hover before you click.

On a desktop, hovering the mouse over a link (without clicking) shows the real destination URL in the bottom-left corner of the browser. If the link text says "Click here to verify your Amazon account" but the URL shown at the bottom points somewhere unrelated to Amazon, it is a phishing attempt.

On a mobile device, long-pressing a link often shows a preview of the URL. Take that one second to look at it before tapping.

Teaching This to Your Parent

The challenge with link safety is that it requires pausing before acting — and scammers specifically design their messages to create urgency that bypasses that pause. "Your account will be closed in 24 hours." "Your package is being returned today." "You must verify immediately."

When you set up these habits with your parent, focus on the pause itself rather than the technical tools. The tools are for you to use when they call you asking "should I click this?" The habit of calling you first is what saves the day.

Consider setting a standing agreement: any message asking your parent to click a link and enter account information gets forwarded to you before they do anything. That one rule prevents most damage.

Checking links safely is one layer of a broader set of protections that can make it genuinely difficult for scammers to reach your parent. The Elder Scam Shield guide covers the complete layered approach — phone filters, financial monitoring tools, what to do in the first two hours of a confirmed scam, and conversation scripts for setting up these protections without triggering defensiveness. It's designed for adult children who want a systematic plan, not a one-time checklist.