Separate the task from the link
Fictional example: Jonas receives a short link saying he must update his delivery address. He expects an order and does not want to dismiss the message entirely. He opens the retailer’s app himself. Within the relevant order, he finds his saved address and the available options for changing it.
The task was “check the delivery address”, not “decode this link”. That distinction avoids unnecessary technical detective work. Even if the short link came from the retailer, the established customer account provides a traceable route to the same transaction.
Use one of three familiar routes
Open an installed app, a trusted bookmark or a web address you already know, typing carefully. If you first need to search for the provider, examine the result and its actual domain. A prominent advertisement does not confirm that a website is genuine.
Then look inside the service for the relevant order, message or setting. A claim that you can complete the task only through the newly supplied link deserves an independent enquiry. A deadline in the message is not evidence that the route is authentic.
Short does not automatically mean fraudulent
Real organisations and individuals use shortened links too. Length alone is therefore not proof of fraud. Conversely, a familiar shortening service does not make the destination trustworthy: it redirects an address rather than automatically endorsing the offer behind it.
For a private invitation, ask the person through an existing contact which service they used and exactly what they shared. Confirm more than whether they sent “some link”. The specific task and intended recipient should make sense.
Keep personal links out of public checkers
A password-reset link, private-album link or invitation may carry access information inside its address. Depending on the service, somebody who receives it may be able to gain access. Do not treat these complete personal links like ordinary public website addresses.
Avoid pasting them indiscriminately into link checkers, public chats or AI applications. If you need help, describe the service and situation without including the personal link. Reach support through the provider’s official website or app.
If you already followed the redirect
Check the actual destination before entering any information. Close an unclear page instead of exploring out of curiosity. A short link alone does not automatically infect a device, but avoid unfamiliar downloads, extensions or approval requests.
If you entered credentials, change them at the genuine service and deal with reused passwords elsewhere too. For exposed card details, contact the card provider. Note what you actually did. Use qualified help for further device checks or unexplained account changes rather than following additional unverified “repair” links.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Should I block every shortened link?
That is not required for this routine. Use independent access for sensitive tasks and check private sharing invitations carefully.
Can a preview safely confirm the destination?
A preview may provide information, but it does not replace checking the origin. Redirects and the actual task still matter.
What if the task does not appear in my real account?
Ask the official provider. Its absence alone proves neither fraud nor the authenticity of the new link.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- BACS: Links in unerwarteten NachrichtenSource review date:
- FTC: Phishing erkennen und unabhängig prüfenSource review date:
- BSI: Irrtümer zur E-Mail-SicherheitSource review date:
