How to check an unexpected short link before trusting it
Verify the sender through an independent route, understand preview limits and decide what to do if a short link asks for information or triggers a warning.
An unfamiliar short link doesn’t show where it really goes. So the first question isn’t “How can I see where it leads?” but “Do I have a good reason to trust this request?” Often you can do what the message asks through a website or app you already know, without opening its link at all.
This guide is for people who receive links, and it uses a made-up message about renewing a club membership. It can’t tell you whether a particular link is safe, and no way of checking a link is completely risk-free. A well-known shortener’s domain, including reunified.link, doesn’t tell you who sent the message or whether the page behind it can be trusted.
Check the request before checking the address
Ask yourself whether you expected this message and whether the request makes sense. A renewal notice from a club you never joined needs checking, not a quick payment. Pressure to act before your account “closes” is a reason to slow down.
Look at the real sender details, but don’t treat a familiar name or logo as proof. The FTC’s phishing advice explains how scammers pretend to be known organizations by email and text, and recommends contacting the organization through details you find yourself. The example here is only practice for making a decision; it doesn’t mean any real message is a scam.
Use an independent path to the sender
For the club, open its website from a saved bookmark or an address you already know, and look for the renewal information there. If you need help, use contact details you found yourself, not ones from the unexpected message. Asking the same unknown sender to confirm their own link doesn’t prove much.
For a work message, follow your organization’s process for reporting suspicious messages. For a personal contact, reach them in a way you’ve used before. Describe the request you got, but don’t forward private links or account details to lots of people. If you can do the task in the organization’s official app, you may not need to check the short link at all.
Understand what a preview can and cannot prove
A label, preview image or short domain shows only part of the journey. Apps handle copying and previews differently, and some previews open the link in the background. Don’t assume that a long press, a link-expanding website or an automatic scan never contacts the site.
Don’t paste private or account-specific links into public link-expanding or scanning sites. What you see when you check a link is only where it went at that moment, for you. In Links, as with many shorteners, the owner can change the destination and send different visitors to different pages, so another visit may end up somewhere else. Links doesn’t offer a safety rating for links or a preview address you can add to a code.
Verify the destination before providing information
If you checked on your own and still want to go ahead, look at the final address and at what the page asks for before you type anything. A club renewal shouldn’t suddenly ask for the password to an unrelated account. If anything doesn’t match what you confirmed, stop and go back through the website or app you know.
A secure connection, shown by the padlock, only protects data on its way to the site; it doesn’t make the site honest. Google’s connection security guidance advises checking the site name even on secure pages. If your browser warns you about a dangerous site, don’t click past the warning to finish a routine task; use the official support route instead. Chrome’s guidance on warnings recommends staying away from flagged sites and keeping protection turned on.
Respond according to what actually happened
Write down what actually happened. Not every click carries the same risk:
| Situation | Useful next step |
|---|---|
| You didn’t open the link | Check the request yourself, or report the message in the app or email service where you got it |
| You opened the page but entered nothing | Close it, and note any download or permission request you saw |
| You entered a password or private information | Go to the real service through a route you know, and follow its steps for securing your account |
| You downloaded a file or installed software | Follow your device maker’s official security advice or your organization’s support process |
Closing the page doesn’t prove your device is clean. If you shared financial or identity details, contact the bank or other provider through its official channels right away. The right response depends on what you shared and which device you used. A shortener’s click count can’t tell you what happened after the click.
Keep a useful report without spreading the link
Keep the original message, the time and anything you noticed, and share them with a trusted reporting channel. Say what you entered or downloaded, if anything. Don’t repost suspicious links, or screenshots with personal details, in public. A good report helps the service investigate without sending more people down the same path.
If you send links yourself, the email and messaging guide explains how clear labels and familiar context help people trust them. Links lets you change where your short links go, but trust still comes from a known sender, a suitable destination and a request that matches what the reader expects.