Suspicious Link? How to Report It Safely

Do not investigate by entering credentials

If you receive a suspicious link, you do not need to log in or install an app to prove it is fraudulent. A screenshot of the message, its sender details and the exact visible URL may provide enough context to begin a report.

Avoid forwarding the link widely with an invitation for others to click. That can expose additional people to risk, even if your intention is to warn them.

Preserve useful, non-sensitive evidence

Record when the message arrived, the platform used, the claimed brand and what action it requested. Where your device permits it, copy the URL as text without visiting it. Do not publish phone numbers, account identifiers, authentication tokens or identity documents in an open forum.

Some shortened URLs reveal little until resolved. A redirect chain can be technically legitimate, but a final destination asking for credentials requires verification through an independent source.

Report through the right channel

Use the abuse-reporting controls built into the messaging app, social platform, browser or email service. When appropriate, provide the legitimate brand with the suspicious link through contact details you have verified independently.

Never rely on contact information supplied by the suspicious account itself. An impersonator may direct you to a second fake support channel to make the scam appear credible.

For the related background, see verifying official links; that guide covers the separate question in more detail.

What if you already clicked?

Simply opening a page is different from downloading software, installing a profile or entering credentials. Identify which action occurred. If you submitted a password, change it through the legitimate service and review other accounts using the same password.

If a file was installed, consult trusted operating-system security instructions and avoid activating more unknown tools. If a one-time code was revealed, follow the provider’s account-security process promptly.

Recognise manipulative messages

Impersonators often use urgency, guaranteed prizes, fake account suspensions or claims that a payment is required to unlock support. Their message may include a copied logo or realistic-looking screenshot. The social pressure is itself a warning sign when it discourages independent verification.

Do not assume a brand-like username is authentic. Usernames and profile images can be imitated, and verified status indicators differ between platforms.

If your question is instead about support impersonation warning signs, use that focused article rather than applying unrelated troubleshooting steps here.

Close the loop safely

After reporting, block the suspicious contact if appropriate and review your account-security settings. Keep a private record of the incident if follow-up is needed, then avoid repeatedly opening the link.

Our official link-verification article explains how to inspect destinations; the fake-support guide explains impersonation tactics. This article focuses on reporting and evidence handling rather than repeating those guides.