An independent awareness initiative · for public-interest education and protection from financial fraud
Arab Center for Financial ConsultingArab Center for Financial Consulting
العربية

Phishing links

Links designed to steal your personal data or login credentials.

Awareness guide

Introduction

Links have become a normal part of everyday digital transactions. You may receive links by email, WhatsApp, Telegram, text message, or even through social media pages. Some of these links are perfectly normal and lead to official websites or secure payment pages, while others may be worth verifying before you click them or enter any information.

Caution becomes even more important when a link is connected to a financial matter, such as:

  • Paying fees.
  • Updating account details.
  • Verifying your identity.
  • Withdrawing profits.
  • Opening an investment account.
  • Paying a tax or commission before a withdrawal.
  • Downloading an app or a file.

In these cases, it is not enough for a link to look "professional" or to have been sent by someone who speaks in a convincing way. What matters most is verifying the source of the link, the reason it was sent, and where it actually leads.

Why are phishing links dangerous?

Clicking an untrusted link can expose you to several risks, such as:

  • Entering your data on an unofficial website.
  • Sharing your password unintentionally.
  • Entering your payment card details on an insecure page.
  • Downloading an unknown file or application.
  • Sharing personal or financial information with an unclear party.
  • Paying an amount through a page whose source cannot be verified.

For this reason, dealing with links calls for a simple rule: do not click, do not pay, and do not enter your details, before you know where the link leads, who sent it, and why.

Payment links: when do they deserve verification?

Some official services do have legitimate, secure payment links, particularly when they are tied to a clear invoice, a known payment gateway, or an official account within the company's website.

The problem starts, however, when a payment link arrives through a direct chat without sufficient supporting information.

For example, if an investment firm or trading platform tells you: "Pay through this link so the withdrawal can be activated," or "These fees are mandatory, pay now through the link."

This is where you should stop and ask some important questions.

A serious, well-organised, licensed company does not typically rely solely on sending a random payment link over WhatsApp or Telegram without:

  • An official invoice.
  • A clear, legal company name.
  • An explanation of the reason for payment.
  • A published fee policy.
  • An official payment gateway.
  • An official email address.
  • The ability to review the request within your account or on the official website.

The mere existence of a payment link does not by itself mean fraud is taking place, but a payment link with an unclear source, unconnected to any official document or official gateway, deserves verification before you pay any amount.

Questions to ask before paying any amount through a link

Before paying through any link, ask:

  • Who sent the link?
  • Is the link accessible from within the official website?
  • Is there an official invoice?
  • What is the reason for the payment?
  • Are these fees mentioned in the terms?
  • Is the company name clearly displayed on the payment page?
  • Is the payment gateway a known one?
  • Can the payment be made through the official account instead of the link?
  • Is there an official email confirming the request?

If you do not receive clear answers, it is best not to pay until everything has been clarified in writing.

Do not let pressure push you into paying

One of the tactics most worth noticing is linking payment to urgency, such as:

  • Pay now or the withdrawal will stop.
  • The link is only valid for a short time.
  • If you do not pay today you will lose the profits.
  • This is the last step before the funds are transferred.
  • Do not tell the bank or anyone else until the payment is made.

Any payment request tied to pressure, fear, or urgency should be treated with caution.

Financial decisions should never be made under stress, especially when the link is sent through a chat rather than through a clear, official channel.

How do you verify a link before clicking it?

Links have become part of most daily transactions, but not every link deserves your trust simply because it reached you.

Before clicking any link related to money, accounts, or investment, pause for a few seconds and ask yourself:

  • Who sent this link?
  • Why was it sent to me?
  • Was I expecting to receive it?
  • Can I verify it through the official website?

These simple questions can help you make a more informed decision.

First: read the full link address

Do not look only at the company name.

Read the entire domain name.

For example, a website name may look very similar to that of a well-known company, but reading the full link address may reveal a difference in spelling or in the domain name itself.

For this reason, do not rely on visual similarity alone.

Second: do not click the link directly from the chat

If a link reaches you through:

  • WhatsApp
  • Telegram
  • SMS
  • Email
  • Instagram
  • Facebook

and it relates to your account or to a payment, it is better to go to the company's official website yourself, then check whether the request appears within your account or through official channels.

This simple step is safer than relying on the link that was sent to you directly.

Third: does the link ask you to log in?

If the link opens a page requesting:

  • Your username.
  • Your password.
  • A one-time verification code (OTP).
  • Your bank card details.
  • Your digital wallet information.

First make sure you are actually on the official website.

Do not enter any information before verifying the full website address.

Fourth: pay attention to payment links

Some companies do send official, secure payment links as part of their normal procedures, particularly when tied to an invoice, a purchase order, or a specific service.

But if a payment link reaches you:

  • Through a chat only.
  • Without an invoice.
  • Without a contract or an official request.
  • Without a clear explanation of the fees.
  • Together with a demand to pay urgently.

You should stop and ask for clarification before paying.

How do payments work at professional companies?

At many well-organised companies, the payment process is typically much clearer, involving things such as:

  • Issuing an invoice bearing the company name.
  • Using an official payment gateway.
  • Sending the request through an official email address.
  • The transaction appearing within the customer's account on the website.
  • Explaining the reason for the fees before requesting payment.

If you cannot connect the payment link to these elements, it is appropriate to ask for more information before transferring any amount.

Fifth: do not let the phrase "this is the last step" affect you

You may receive messages such as:

  • This is the last step before the withdrawal.
  • Pay now and the funds will be transferred immediately.
  • The link will expire within an hour.
  • Do not delay the process.

Before making any decision, ask:

  • Why can't the payment be made through the official account?
  • Where is the invoice?
  • Where is the fee policy?
  • Why can't I review the request within the website?

Urgency alone should never be a sufficient reason to pay.

Sixth: check the payment gateway

If you decide to pay, review:

  • Is the company name clearly displayed?
  • Is the payment gateway a known one?
  • Does the merchant information appear?
  • Does the payment page use a secure connection (HTTPS)?
  • Does the party's information match what is published on the official website?

A payment page alone is not enough; it must also be linked to a party that can be verified.

Checklist before clicking any link

Before opening any financial link, ask yourself:

  • Do I know who sent the link?
  • Was I expecting to receive it?
  • Have I read the full website address?
  • Can I reach the same page from the official website?
  • Is there a clear explanation for this link?
  • Does the link ask for sensitive information?

If any of these points is unclear, it is best to stop and verify first.

The most common types of links worth verifying before use

Not all links you receive online are the same — some lead to official websites, while others may use names or pages that resemble well-known sites.

For this reason, understanding the different types of links helps you make a more informed decision before clicking them or entering any information.

First: links that resemble official websites

A link may carry a name that is very close to that of a well-known company or institution.

The difference may be:

  • An extra letter.
  • A hyphen (-) in the domain name.
  • A different domain extension.
  • An extra word before or after the company name.

For this reason, read the entire website address, and do not rely solely on the company name shown on the page.

Second: payment links

Some companies do send official payment links through their own payment gateways.

But if a payment link reaches you through a direct message without:

  • An official invoice.
  • A clear explanation of the fees.
  • An official email.
  • The request appearing within your account on the website.

It is best to stop and verify before entering any information or making any payment.

At many professional companies, the payment process is part of a clear system the customer can review, not merely a link sent through a chat.

Third: links that request a login

A link may lead you to a page requesting:

  • Your username.
  • Your password.
  • A verification code.
  • Your bank card details.
  • Your digital wallet details.

Before entering any information, check:

  • The website address.
  • The domain name.
  • The party that owns the website.
  • Whether you reached the page through the official website.

If you can reach the same page from the official website, that is safer than relying on the link that reached you in a message.

Fourth: links for downloading apps or files

You may receive a link to download:

  • An app.
  • An update.
  • A PDF file.
  • A Word document.
  • A compressed file.

If you were not expecting this file, or cannot verify its source, it is best not to download it until you are certain it comes from the official party.

Fifth: shortened links

Some services use shortened links to make sharing easier.

However, shortened links do not directly reveal their real destination, so it is best to know who sent it and why before clicking it.

If the link relates to money, accounts, or personal data, it is better to access the service through the official website rather than through the shortened link.

Why are links used in phishing attacks?

Links are sometimes used to create pages that resemble official websites in order to get the user to enter their information.

For this reason, it is not enough for a page to look professional; you should also make sure of:

  • The website address.
  • The owning party.
  • The way you reached the page.
  • Whether the information matches the official website.

How should you handle any link related to money?

If you receive a link related to:

  • Investment.
  • Withdrawing funds.
  • Paying fees.
  • Updating your account.
  • Restoring access.
  • Verifying your identity.

It is best to follow these steps:

  • Do not click it directly.
  • Open the official website yourself.
  • Log in through the official website.
  • Check whether the request appears within your account.
  • If you find no information, contact the party through the contact channels published on its official website.

Checklist before clicking any link

Ask yourself:

  • Do I know the party that sent the link?
  • Does the link lead to the official website?
  • Can I reach the page from the official website?
  • Do I understand the reason for this link?
  • Is there an official invoice or document if the link relates to payment?
  • Would I feel reassured opening the official website instead of clicking the link?

If any of the answers is unclear, it is best to stop until you have verified the information.

Always remember

A link by itself is not proof of trustworthiness, nor is it proof of a problem.

But when money or personal data is involved, verifying the source of the link and the party behind it matters more than how quickly you click it.

The most common mistakes people make when dealing with links

In many cases, the link itself is not the problem — it is the way we deal with it.

Some people make a quick decision to click the link, enter their information, or make a payment, before confirming the source of the link or its purpose.

For this reason, the best form of protection is to pause for a few minutes before taking any step.

First mistake: clicking the link as soon as it arrives

You may receive a message such as:

  • Your account has been updated.
  • You must confirm your identity.
  • Click here to complete the withdrawal.
  • Click here to activate your account.
  • Pay now to complete the transaction.

Before clicking the link, ask yourself:

  • Was I expecting this message?
  • Can I access the service from the official website instead of the link?
  • Do I know the party that sent the link?

If the answer is unclear, it is best not to click until you have verified it.

Second mistake: entering your details straight away

Even if the website looks professional, do not enter:

  • Your password.
  • A one-time verification code (OTP).
  • Your bank card details.
  • Your digital wallet details.
  • Your recovery phrase (seed phrase).

until you are certain you are actually on the official website.

Third mistake: paying money through a link alone

One of the situations most worth verifying is being asked to transfer an amount through a payment link sent within a chat, with no clear system or official documentation behind it.

Before paying, ask:

  • Have I received an official invoice?
  • Was the request sent from the company's official email?
  • Can I see the fees within my account on the official website?
  • Is there a clear explanation for the reason for this payment?
  • Can I carry out the transaction through the payment gateway on the official website instead of the sent link?

How do payments work at professional companies?

At organised, licensed companies, the payment process is usually part of a clear system the customer can review.

The customer will typically find:

  • An invoice bearing the company name.
  • A reference number for the request.
  • A clear explanation of the service or fees.
  • An official payment gateway linked to the website.
  • Confirmation through the official email.
  • A record of the request within the customer's account.

If all you receive is a message through a messaging app containing nothing but a payment link, it is appropriate to ask for further clarification before transferring any amount.

Fourth mistake: responding to pressure

Phrases such as these may be used:

  • The link will expire within minutes.
  • If you do not pay now the request will be cancelled.
  • You will not be able to withdraw after today.
  • This is the last chance.

Important financial decisions should never be based on pressure or urgency.

If you feel that time is the only factor pushing you to pay, it is best to stop and reassess the situation.

Fifth mistake: not reviewing the link after opening it

Even after opening the link, keep verifying.

Review:

  • The website address.
  • The company name.
  • The payment method.
  • The presence of contact information.
  • The presence of a privacy policy and terms of use.

If you notice any discrepancy or ambiguity, it is best not to proceed until you have confirmed the information.

How do you build a safe habit before clicking any link?

Make these steps a permanent habit:

  • I read the entire link.
  • I reach the official website myself whenever possible.
  • I do not pay through a link alone if I do not understand the reason for the payment.
  • I review the invoice or the official request.
  • I verify the official email.
  • I review the fee policy if the payment relates to a financial service.

A golden rule

If you can carry out the same transaction from within the official website or your official account, that is generally safer than relying on a link that reached you through a message or a chat.

Conclusion

Online links have become an essential part of our daily lives, whether when using banking services, shopping online, managing accounts, or dealing with financial and investment services.

At the same time, it has become essential to treat any link related to money or personal data with a higher degree of awareness.

The goal is not to fear all links, but to know how to verify them before clicking or using them.

The more you rely on the official website, review the link address, understand the reason for the request, and take your time before entering any information or making any payment, the better able you become to protect your information and reduce the risks.

The content published on this site is for awareness and general knowledge purposes only, and does not constitute legal, financial, or investment advice.