islegit

3 minute read

The lock icon does not mean safe

No. The padlock only means the connection between you and the website is encrypted. Scam websites get padlocks for free just like real ones, and almost all of them have one. To tell whether a site is real, read the web address itself, especially the name just before .com, .org or the other ending.

How to read a web address

The part that matters is the main name right before the first single slash: the last two pieces before /.

  • https://www.paypal.com/signin belongs to paypal.com. Real.
  • https://paypal.com.account-verify.net/signin belongs to account-verify.net. Fake. The word PayPal is just decoration at the front.
  • https://paypa1.com uses the number 1 instead of the letter l. Fake.
  • https://secure-chase-login.com is not chase.com. Fake.

Quick rules

  • Type important addresses yourself or use a bookmark. Do not search for your bank; scam ads can sit above the real result.
  • If a link came in a text or email, do not trust it, even if it looks right.
  • Paste any address you are unsure of into the link checker.

Related

Next