Skip to content

How to find all accounts linked to your email

Why check accounts linked to your email?

When you link accounts to your email, it’s like you’re taking a shortcut—and sometimes that comes with a little risk. That’s why you should be aware of what could go wrong.

So, for instance, if an account that is associated with your email gets compromised, the attackers could learn your email address and then spam you with phishing messages. On the flip side, if your email gets exposed (say, on the dark web), hackers might try to break into and access your linked accounts.

But don’t panic just yet—if you haven’t noticed any weird behavior on your accounts, you’re probably fine. In case you have doubts, use an online tool to check if your email or any other account has been compromised. Basically, what we’re simply trying to say here is that it’s generally wise to be mindful of your digital footprint and know which platforms and services are linked to your email.

How to check accounts linked to your email providers

One of the most common ways to link accounts is by connecting an account—like one for shopping, gaming, or other services—to your email, such as Google, Outlook, or Yahoo. Let’s go over the steps to find all the accounts associated with your email, depending on which email provider you use.

Google account

  1. Go to your Google Account settings and click on “Security.”

  2. Find the section called “Your connections to third-party apps & services.”

  3. Click “See all connections” at the bottom to view the full list of accounts linked to your Google account.

Outlook and Microsoft account

  1. Sign in to your Microsoft Account.

  2. Click on “Privacy” or “Security” in the menu.

  3. Find the “Apps and Services” section to see the accounts linked to your Microsoft account.

Apple account

  1. Go to the Settings app on your iPhone or iPad (or open System Settings if you’re using a Mac), then tap your name.

  2. Find and tap “Sign in with Apple” to view the list of all accounts you’ve signed into using your Apple ID.

Yahoo account

Unfortunately, Yahoo doesn’t offer a way to directly see all the external accounts linked to your Yahoo email. So, there’s no easy way to get a full list of all the accounts using your Yahoo address.

How to check accounts linked to your social media accounts

Another way to link your accounts is by connecting them to one of your social media profiles. If you’ve already done that, here’s how you can check which accounts are linked to your Facebook, X, Instagram, or LinkedIn.

Facebook

  1. Log in to your Facebook account, click on your profile picture in the top-right corner, and then select “Settings & Privacy.”

  2. In the left sidebar, click “Apps and Websites” to see a list of online services linked to your Facebook account.

X (Twitter)

  1. Open the X app.

  2. Tap the profile icon in the top-left corner and select “Settings and Privacy.”

  3. Click on “Apps and Sessions” to see all accounts linked to your X account.

Instagram

  1. Open the Instagram app and go to your profile.

  2. Tap the three horizontal lines in the top-right corner.

  3. Go to “Settings,” then “Account,” and “Linked Accounts.”

LinkedIn

  1. Open LinkedIn

  2. Click on your profile icon in the top-right corner and select “Settings & Privacy.”

  3. Under the “Account” tab, click “Partners and Services.”

Other options

Although checking which accounts are linked to your email or social media is usually pretty straightforward, sometimes it can still get tricky—especially if you’ve been locked out of your accounts. So, what are your options then?

In this case, you’ll have to rely on the information you already have and piece things together to figure out what accounts are linked to your email or social media. If you still have access to your email, try searching through your messages for any information about linked accounts. You can also check your browser history to see which online services you’ve used and possibly signed into with your email or social media.

Another option is to use account recovery tools. These can help you verify which email or phone number is tied to your account and might offer hints or recovery links to help you regain access.

What to do with accounts you no longer use

If there are online accounts you no longer use but that are still linked to your email, it’s a good idea to delete them to avoid any potential data exposure or unauthorized access.

But if you don’t want to delete them for some reason, at least consider boosting their security. You can do this by creating a super-strong password (around 18 characters long with a mix of uppercase and lowercase letters, numbers, and symbols), turning on two-factor authentication (2FA), and maybe even unlinking them from your email or social media accounts. That way, you’ll keep them safer even if they’re not actively in use.

How to better manage your online accounts

It’s simple: if you want easy logins without sacrificing security—or even better, want to boost your account security—then it’s time to try a solid password manager like NordPass.

NordPass is an end-to-end encrypted password manager that allows you to securely store and manage your passwords, credit card details, and other sensitive info. It makes logging in a breeze by autofilling your credentials across all major browsers and devices. Plus, it can generate strong passwords on the spot, monitor the dark web for any signs of your data being compromised, and even mask your email when signing up for newsletters or services.

With NordPass, you get the same convenience of linking accounts for easy logins, but with far more protection to help you avoid data leaks and account lockouts. So, give NordPass a try and see how it can make your online life easier and more secure.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

What to do if your iPhone warns you of a compromised password

Getting a security notification is always unexpected and stressful. So when a compromised password warning pops up on your iPhone, it’s completely normal to feel a little unsettled. Let’s go over what this notification means and what steps you should take if you see it.

 

What is a compromised password notification on an iPhone?

Basically, an iPhone notification about a compromised password appears when Apple detects that a password you’ve used on a website or app has been exposed. This notification is sent so that you can change your password immediately to prevent data leaks and protect the account associated with that compromised password.

 

How was your password compromised?

It’s difficult to tell exactly how one of your passwords got compromised, as there are so many ways. Cybercriminals use all sorts of methods—like phishing, credential stuffing, social engineering, and brute-force attacks—to try to steal your passwords. So, if one of your passwords has been compromised, it may have been due to one of these tactics. It could also be that your password wasn’t strong enough to begin with, or that it was leaked in a data breach of a company whose services you use.

 

How does Apple know your password is compromised?

Apple detects compromised passwords through an iCloud Keychain feature that checks your saved passwords against a database of known data breaches. When a breach occurs, Apple compares your passwords to this database to determine if any have been exposed. If a match is found, Apple notifies you that your password has been compromised.

 

How to find compromised passwords on your iPhone

To find compromised passwords on your iPhone, just go to “Settings” and then “Passwords.” Once you’re there, look for any alerts with a red triangle or under “Security Recommendations.” If any of your saved passwords are compromised, you’ll get a notification, and Apple will suggest updating them for better security.

How to fix a compromised password

If you’ve received a compromised password notification on your iPhone, you must act immediately. Here’s what you should do:

  • Change your password to a stronger one—aim for at least 18 characters, with a mix of letters, numbers, and special characters.

  • Enable two-factor authentication (2FA) for extra protection on your account.

  • Check other accounts where you’ve used the same password for any suspicious activity, and update those passwords too.

  • Start using a password manager to securely store and manage your passwords.

 

How to stop your iPhone from sending compromised password notifications

To stop your iPhone from sending compromised password notifications, just follow these steps:

  1. Open the “Settings” app.

  2. Scroll down and tap on “Passwords.”

  3. Click on “Security Recommendations” at the top.

  4. Turn off “Detect Compromised Passwords.”

 

How to enhance the security of your passwords and accounts

Online threats can strike at any time, so it’s crucial to stay vigilant and use the right tools to protect your data. One of the most effective ways to do that is with a password manager. You might be thinking, “But iPhones come with a built-in password manager, right?” And while using it is definitely better than nothing, it doesn’t offer the same level of security as some third-party options like NordPass.

NordPass is a top-tier password manager that’s not only easy to use but also available across all major platforms and browsers, including iOS. Unlike Apple’s built-in password manager, NordPass uses a more advanced encryption algorithm (XChaCha20) to keep your data safe. It can also generate strong passwords on the spot and sync your passwords across all your devices. Plus, it offers much more than just password management. With features like Data Breach Scanner, Password Health, and Email Masking, NordPass goes the extra mile to enhance your online security.

So, if you’re serious about protecting your passwords, give NordPass a try and see how it can improve your online experience.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Navigating tax season safely: an overview of credential security risks

The tax season has always been a critical time for both individuals and businesses, but it has never been quite as fraught with cyber threats as it is these days. The hard shift to digital filing—along with a constantly evolving threat environment—has turned this annual ritual into a prime time for cybercrime.

 

In 2024 alone, the Internal Revenue Service (IRS) uncovered $9.1 billion in tax fraud cases and received nearly 300,000 reports of identity theft. Whether it’s phishing emails designed to trick filers into disclosing personal details or sophisticated malware operations targeting tax professionals, cyber crooks during this period are disturbingly active. Today, we dive into the scope of these threats, examine their real-world implications, and provide practical steps to help mitigate them.

The landscape of tax season cyber threats

Tax season generally stretches from January to mid-April, when an estimated 165 million Americans and numerous businesses hustle to prepare and file tax returns. About 80 million of those returns are prepared by Certified Public Accountants (CPAs), according to recent industry data. Unfortunately, cybercriminals treat this turn to digital transactions as an annual opportunity and launch tailored attacks that aim to exploit both individuals as well as companies.

Phishing campaigns 

One of the most common attack vectors is phishing—where criminals send bogus emails designed to trick recipients into unsuspectingly providing sensitive personal data. These emails may appear to be from the IRS or reputable tax prep services, complete with official logos or references to “overdue payments.” A 2024 Hornetsecurity report pegged phishing at 39.6% of all email-based attacks, a trend amplified during tax season.

Malware and ransomware 

Tax forms often contain everything a hacker needs for identity theft: Social Security numbers, addresses, and banking details. And once cybercriminals gain access to your system—often via hidden malware in an attachment labeled “tax form” or “software update”—they can install spyware, key loggers, or even launch a full ransomware attack. Faced with a major filing deadline, victims might be more inclined to pay a ransom rather than miss the cut-off for submission.

“Ghost” preparers and fake platforms

Cybercriminals have also found success posing as tax professionals. In such a scenario, an unsuspecting taxpayer hands over a trove of personal information—bank account details, W-2 forms, Social Security numbers—only to see fraudulent returns filed in their name. The IRS warns that these “ghost” preparers usually vanish after submitting false forms and pocketing refunds—with identity theft-related tax fraud costing American taxpayers $5.5 billion in 2023.

Business-focused threats 

For small and midsize businesses, there’s another layer of complexity. Employee data—including Social Security numbers, addresses, and payroll information—often reside on shared drives or distributed networks. A single compromised password can open the door to large-scale identity theft or financial fraud. Given that many businesses rely on internal accounting departments or external consultants, the rate of data exchange grows. Each endpoint—whether an employee’s laptop or a tax preparer’s login credentials—can become a gateway to a breach if not safeguarded properly.

Why credential security matters

Data breaches don’t usually happen because a hacker brute-forces encryption algorithms. More often, criminals follow the path of least resistance, which tends to be simple or stolen passwords. Verizon’s 2024 Data Breach Investigations Report found compromised credentials behind 74% of financial sector attacks. And so tax season, with its sudden surge in data transmissions, provides an even bigger opportunity.

Credential stuffing attacks

Cybercriminals purchase stolen username-password pairs on the dark web and systematically test them on popular platforms. If you’re in the habit of reusing passwords, a single breach on one platform can open up multiple high-value accounts to intrusion—including those used for taxes.

Email account takeover

If hackers gain access to an email account, they can reset passwords on numerous services, intercept 2FA codes (if poorly implemented), or conduct spear-phishing attacks against your contacts. During tax season, access to a CFO’s or finance manager’s inbox is a potential gold mine.

Shared passwords for personal and work accounts

A surprisingly large number of incidents stem from people using the same or slightly modified passwords across multiple sites. If an attacker compromises your personal social media password, they can try variations of that password on your business or tax accounts.

With so many potential vulnerabilities arising from insecure credentials, having a robust and systematic approach to password management is critical. Employing a tool like NordPass helps create, store, and even share unique, complex passwords across a network of trusted employees or family members without the friction that leads to risk-laden “shortcut” practices.

Real-world repercussions of tax season breaches

Cyber threats may sound abstract until you experience them firsthand, unfortunately. So let’s consider a few scenarios that can easily play out during tax season.

Hijacked refunds

Criminals who gain access to your tax software account can alter returns, inflate refunds, and have the money deposited into their own accounts. Not only are you left without the anticipated refund, but you could be flagged for fraudulent activity by the IRS. Correcting these records requires time-consuming phone calls, paperwork, and sometimes legal counsel.

Identity theft and financial fraud

Tax documents typically hold Social Security numbers, addresses, and full legal names—crucial data for identity thieves. Armed with this information, cyber crooks can open credit lines, apply for loans, and even file additional fraudulent tax returns under your identity. The IRS estimates that scammers committed $5.5 billion in tax fraud in the last year alone, much of it fueled by stolen credentials.

Operational disruption and ransomware

If a ransomware attack locks down your systems during peak filing season, you may be faced with the unenviable choice of paying the ransom or missing the filing deadline. When your business’s entire payroll system is frozen, you stand to lose not only money but also the trust of your employees, clients, and partners.

Legal and regulatory trouble

Businesses are required by law to protect employee data. Should a breach involving W-2 forms occur, state and federal regulators might levy hefty fines, and employees could file lawsuits. For small businesses, these legal battles can negatively impact public reputation or even outright ruin the business financially. 

Tips for protecting credentials and mitigating risk

Given the scale of digital threats, securing your online identity during the tax filing process necessitates proactive strategies. Below are tangible measures for individuals and organizations.

Use strong, unique passwords

Avoid dictionary words, common phrases, or personal references. Never reuse passwords across services, especially for tax prep, payroll systems, and personal email accounts.

Consider adopting a trusted password manager such as NordPass, which can generate intricate passwords and store them securely.

Enable multi-factor authentication (MFA)

Whenever available, activate MFA on all platforms connected to your finances or email. This extra verification layer can help thwart criminals who may have stolen or guessed your password.

Stay wary of suspicious links and attachments

Phishing remains the easiest door into your personal or corporate systems. Even a single click on a malicious link or attachment can deliver spyware or ransomware. So make sure to always check the email sender’s address carefully, and manually visit official IRS or tax software sites by typing in the address rather than clicking a link.

Conduct routine account monitoring

Regularly review bank statements, credit reports, and your IRS tax account. If you see unfamiliar activity, act immediately. If you’re a business, schedule monthly or quarterly audits of software access logs to identify potential anomalies.

Update software and systems

Ensuring your operating system, antivirus, and tax software are current can close known vulnerabilities that criminals might aim to exploit. Encourage employees to run updates as soon as they’re available, rather than postponing them.

Limit access privileges

In a business environment, not every staff member needs access to all financial or payroll details. Adopt the principle of least privilege to shrink your attack surface. 

For additional protection, consider segmenting your network so that critical tax data is walled off from the rest of the organization’s operations.

Verify tax preparers’ credentials

Legitimate preparers must have a Preparer Tax Identification Number (PTIN). A lot of Americans entrust CPAs and other pros to handle their tax returns, so it’s vital to confirm the authenticity of anyone who deals with your finances. “Ghost preparers” who refuse to sign returns or demand unusual payment methods are immediate red flags.

Maintain an incident response plan

Outline the steps you’ll take if a breach does occur: who will you call first? How will you isolate infected systems? For businesses, having a tested response plan can drastically minimize downtime and financial loss in a worst-case scenario.

Security-first culture

Technical defenses cannot fully compensate for employees or household members who lack security awareness. Training and vigilance must become habits. When staffers comprehend the risks of phishing emails—or why weak passwords are a liability—they usually become active participants security-wise.

Tax season, with its tightly packed deadlines and sudden influx of external correspondences, is especially prone to mistakes. Criminals place their bets on hectic schedules and the assumption that nobody reads the fine print in a rush. By fostering an environment where it’s standard practice to confirm suspicious queries or check unplanned attachments, you reduce the chance of inadvertent leaks.

Of course, tools like NordPass help avoid the pitfalls of shared spreadsheets or stray Post-it notes with login data by providing secure credential storage and encrypted sharing, drastically reducing the friction that leads people to reuse or create weak passwords. 

Beyond tax season: building a resilient foundation

Keeping digital attackers at bay during tax season shouldn’t be a last-minute scramble. It must be part of a larger, year-round approach to cybersecurity. Tax season simply throws these issues into the spotlight because the stakes—and the volume of targeted scams—are higher.

View security as ongoing

While certain threats may peak from January to April, scammers work continuously. Make sure your security protocols— from patch management to employee training—are consistent and not just “tax-time activities.”

Leverage intelligence and reports

The IRS publishes alerts on emerging scams. Likewise, major cybersecurity outlets offer real-time threat briefings. By staying updated on known risks, you can proactively adjust or harden policies.

Invest in infrastructure

For businesses, upgrading legacy systems and implementing advanced threat detection can prevent criminals from exploiting outdated software. For individuals, maintaining secure Wi-Fi networks and establishing personal firewalls can be an impactful step.

Strengthen vendor and partner relationships

If your business deals with external tax preparers or payroll service providers, insist on strong security practices and confirm that they uphold data-protection protocols. Transparent discussions about cybersecurity responsibilities can avert confusion or blame in the event of a breach.

Encourage swift reporting

If something does go wrong—like an employee clicking a suspicious link—delays in reporting can allow malware to spread or cyber crooks to siphon off data unnoticed. Cultivate a culture where immediate reporting, rather than fear of reprimand, is the norm.

Wrapping up

Amid the hustle of calculating deductions, aligning your statements, and meeting deadlines, it’s all too easy to underestimate the value of robust credential security. Yet, in the end, the difference between a secure, worry-free filing and a catastrophic breach often hinges on consistent, disciplined adherence to fundamental security principles. As you gather receipts, consult accountants, or log in to tax software, remember that each login credential is a potential gateway. By making calculated, informed decisions, you maintain control over your security.




About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

How do you know if your email has been hacked?

Signs that your email could have been hacked

It’s not always immediately obvious that your email has been hacked, but there are signs you can look for that should alert you if something is wrong. Here’s what to watch out for:

Unexpected password change notifications

If you receive a notification or email saying that your password has been changed, and it wasn’t your doing, it’s highly likely that someone has taken over your email account. After all, who else could have done it? If you haven’t shared access to your email with anyone before, this situation should raise a major red flag. Additionally, if you receive messages indicating that someone is trying to change your password, stay alert as clearly someone is targeting your account and attempting to break in.

Login alerts from unknown locations or devices

Another disturbing message you might receive is about a successful login to your email account from an unfamiliar location or device. If you haven’t recently changed your computer or mobile phone, or you’re not on holiday somewhere far from home, this could mean that someone has bypassed your email security and gained access to your account. Treat every such notification very seriously.

Emails you didn’t send appearing in your “Sent” folder

The “Sent” folder in your email account should only contain messages you remember sending to your contacts. If you notice emails you don’t recognize, it could indicate that someone has hacked your account and is using it to send malicious messages that appear to come from you.

Strange or missing emails in your inbox

Having weird, unknown emails in your “Inbox” folder is also a sign of a potential email break-in. The same applies if you cannot find a specific email that you are certain was there before. So, if your inbox contains unfamiliar messages or is missing something, stay vigilant—it may indicate that your email account has been hacked.

Complaints from contacts about receiving spam from you

Have any of your friends told you they got a strange email from you saying you’re in trouble and need money? Or maybe one of your contacts got a message asking for your or their personal information? If you haven’t sent any messages like that, but people are getting them from your email, it could mean someone’s hacked your account and is using it to try and scam the people you know.

Being locked out of your email account

If you can’t log in to your email on any device you usually use, it might mean someone’s hacked your account and changed the password to lock you out. Unless you’ve forgotten your password or made a typo, take this seriously and assume your email’s been hacked.

How to check if your email has been hacked

To verify if your email account has been compromised, you’ll want to keep an eye out for the signs we’ve mentioned earlier and also do a little digging on your own.

First off, review your login activity. Most email providers, like Google, Yahoo, and Microsoft Outlook, allow you to check your account’s login history, including the IP address, device, location, date, and time of your recent logins. If anything looks unfamiliar, that’s a red flag.

Next, check for any strange, unexpected activity in your email inbox and the “Sent” folder. Go over the messages from the past few days/weeks and see if there are any phishing emails sent from your account or password reset emails you didn’t request. If something feels off, make sure to secure any accounts that might be affected.

Also, it’s a good idea to see if anyone outside your trusted circle has been granted permissions linked to your email, or if your account has been used to sign in to any services you don’t recognize.

Lastly, you can use online tools, like the Data Breach Scanner from NordPass, to check if your account has been exposed. Simply enter your email address, and the tool will scan the dark web for any mentions to determine if it is at risk.

What to do if you suspect your email has been hacked

If you suspect your email has been hacked, you might be wondering, “What do I do now?” Fortunately, you’re not left helpless—you can take steps to regain access to your account. Here are some things you should do:

  • Change your email password right away to prevent unauthorized access. TIP: Use NordPass’ online Password Generator to create a new, strong password in no time.

  • Enable two-factor authentication (2FA), so that logging in to your email requires more than just a password.

  • Use the “Log out of all devices and sessions” option to ensure anyone who’s gained access is immediately logged out.

  • If you can’t access your account, report the issue to your email provider right away. They’ll help you restore access and block any outsiders from using your account.

If you need more information, we have another article titled “What to do if a scammer has your email address,” which provides detailed instructions on how to proceed when an unauthorized party has taken control of your email account.

How to prevent your email from being hacked

There’s no single technique you can use to protect your email from being hijacked, but combining a few methods can significantly boost your email security. First, how safe your email is depends largely on your online activities and how you share sensitive information. If you’re careful about where and with whom you share your email address, you’re off to a good start.

For an extra layer of protection, a password manager like NordPass can be a game-changer. Not only can it keep all your passwords—including your email password—safe in an encrypted vault, but it can also generate strong passwords on the spot. If your email password is weak or outdated, NordPass will notify you. Plus, with the Data Breach Scanner feature, you’ll get an alert if your email is compromised in a data breach. NordPass also includes Email Masking, which lets you use a fake email address when signing up for services or newsletters, protecting your real email from exposure.

So, if you want to enhance your email security and feel more confident online, NordPass is the way to go. Try the free 14-day trial and see how it can improve your online experience.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

How to check if a link is safe?

Imagine: a newsletter of an online shop you like drops in your inbox’s spam folder. You open it anyway—after all, it’s not unusual for these emails to be incorrectly marked as spam. Not all components are loading as they should, but it looks convincing enough for you to open the link to see more. Once on the page, you sense something’s off. You take a closer look at the URL bar and realize this uncanny valley feeling is not unwarranted—it’s similar enough, but not the actual website. You’ve accidentally ended up clicking on a scam link.

Creating a spoof website remains a popular phishing technique among cybercriminals, and it can, unfortunately, convince unsuspecting users to give up their sensitive information themselves. Let’s learn how to check if a link is safe before clicking it to dodge such scams and stay safe online.

Why should you check if a link is safe?

It’s really simple—by opening an unsafe link, you risk your digital safety and put your private data at risk. Scam links are a prominent tool in phishing campaigns. Their goal is to get you to inadvertently reveal valuable personal information yourself. Phishy links aim to trick the user by imitating a reliable service. By the time you realize the website you visited wasn’t real, your data may already have made its way to the dark web.

Scam link campaigns try to toy with the users’ emotions and rationale. They often build a sense of urgency, for example, by convincing the user that there’s a problem with an account or a transaction. Likewise, they want to build trust with the target by imitating the service the user would otherwise believe to be real.

Your login details are valuable to scammers for a few reasons. One, they can sell credentials in bulk on the dark web for profit. Two, users still often reuse the same password for multiple accounts, meaning that breaching one can open the doors to many others, including governmental, medical, or banking accounts.

Speaking of banking, scam sites frequently replicate e-commerce pages, as fake purchases allow hackers to collect users’ payment information, like credit card numbers. They can then use this data in financial scams, like falsified tax returns or money laundering.

Personal addresses can also be stolen via scam sites, allowing hackers to spam not just your digital inbox, but your physical mailbox as well. Your address can then be falsely used to register fraud companies or to forge your identity online.

Malware is another risk you can run into when you’re faced with a scam link. Websites have different interactive elements that, once clicked, can download a file on your device. It’s an easy way for cybercriminals to infect your computer with malware like a Trojan virus, steal your data, install a keylogger, or cryptojack your device.

Overall, scam sites can wreak havoc on the security of your personal data. Learning to spot scam links and avoiding them altogether is a surefire way to keep your identity secure both online and in the real world.

How a scam link works

While the emergence of AI has made it more difficult to tell scam sites apart from legitimate ones, there are some telltale signs that they’re built with nefarious intentions.

The scam domain is often very similar to the actual page. It might use extra dashes and a subdomain to confuse the user. If the scam link leads to a mobile app, it might copy the logo and name of the service as well, replacing a few characters or making it appear more generic to avoid getting flagged by app store algorithms.

Not all scam links are overtly similar to their “inspirations.” Often, scammers use shortening services to create a custom coy link that does not immediately reveal the domain or allow the user to guess where it might lead. Such links can spoof parcel tracking sites, discount codes, and similar, more personalized offers and services.

Just clicking on a scam website does not mean that your device has been immediately hacked or that your data has been stolen. Such websites usually require you to perform actions yourself, like entering your login credentials, downloading a file, or connecting to a cloud account, before they can do any real damage. This means you have time to investigate the website to determine whether it’s legitimate or not.

How to tell if a link is safe

If you’re suspicious about a URL, there are a few ways to check whether it’s safe to open. It’s pretty easy to analyze the link yourself without opening it.

  • Check browser history

    If it’s a site you’ve visited before, you can copy and paste the URL into your browser’s search bar or history to see if it finds any previously visited matches.

  • Hover over the link

    If the link is embedded in a text like “Click here” or “Log in,” you can hover over it with your mouse to preview the URL, or right-click and copy it. Then, paste it safely into an empty document to get a better look at the domain.

  • Compare with a legitimate link

    Likewise, you can take both the suspicious URL and the legitimate one, paste them into the same file, and compare the characters. Hackers are likely to use tricks like replacing the letter O with a zero or using a lowercase L instead of an uppercase i to trick the user. If the link is a match, proceed as usual. If not, you can run it through a deeper check.

  • Use a link-checking tool

    You can use a dedicated website that scans a URL and sees if it’s safe. For instance, NordVPN’s Link Checker scans the URL for any malware or phishing threats and warns you if the link is unsafe, protecting you from a potential cyber incident. You can also attempt to find the site’s domain information to see if the registration is recent or matches the legitimate service’s data.

  • Look for the HTTPS protocol

    Although it’s not recommended to open suspicious links, if you’ve done so, look at the protocol part of the URL. If you don’t see HTTPS at the beginning of the link, the site is not using a secure protocol, and your data is not being encrypted. You should close such a website immediately.

How to check if a link is safe on an Android or iOS device?

Checking whether a link is safe is a lot easier on a desktop—you can see the link preview on the browser, quickly check the security protocol, and even close the tab with a simple keyboard shortcut instead of a mouse click. With smartphones, matters are a little more fickle.

Links sent to a phone can be harder to copy, depending on app restrictions. The touchscreen also makes it harder to close or leave a suspicious link without accidentally pressing an interactive part of the screen. If the website contains pop-ups, closing them can also be a tough battle to win. Here’s how to check whether a link is legit to stay safe while browsing your phone.

For iOS phones, Safari offers a tool that alerts you if you attempt to visit a scam page. To use it, go to your phone settings, find “Safari,” and switch on “Fraudulent Website Warning.”

If you’re using an Android device, you can activate secure browser settings:

  1. Go to your device settings and find the “Security and privacy” category.

  2. Select “More security settings.”

  3. Select “Android Safe Browsing” and toggle on “Use live threat detection.”

I think I clicked a scam link. What should I do?

Here’s some good news—simply clicking on the link doesn’t necessarily mean damage has been caused. Scam URLs are usually just one step of the process. Nevertheless, if you think you’ve opened a phishy site, act with caution.

If you opened the website

If you’ve opened a link and can clearly tell it’s a scam, close the tab immediately and delete it from your browser history to avoid accidentally reopening it. Alternatively, open the link using an incognito tab. This prevents the site from potentially accessing your personal data and keeps it from appearing in your history.

Make sure you don’t click anything on the site—even if you avoid the obvious interactive buttons, other design aspects and the empty background space might have been deliberately developed to be interactive. Do not enter any personal information, like login credentials, address, or payment information.

If the website prompted you to log in and you entered your credentials, make sure to change your password on the real site immediately. If the account did not have multi-factor authentication activated yet, consider switching it on. That way, even if the cybercriminals have taken your personal details, you will lower the chances of them overtaking your account.

If you downloaded a file

If the website caused you to download a file and you could not stop the download process, do not open it. Instead, delete the file from your device permanently. The file may contain malware that could infect your computer and gain access to your data. As a precaution, scan your device using antivirus software even after you’ve deleted the file.

Getting ahead of the fallout

Keep an eye on potentially breached accounts for the foreseeable future in case of suspicious activity or misuse. If you happen to use the same password for other accounts, update those login details as well. Make sure you use new and unique passwords for each account—you can easily do this with a password generator.

A good course of action is to contact the legitimate service provider to let them know about the scam. That way, criminal activities can be detected faster, and you can protect yourself and others from falling prey.

Staying secure online

Suspicious links are a sneaky online threat—they’re easy to overlook, but falling for them can have huge consequences for your personal data. So, make sure you stay alert, master the art of dodging insecure links, and get a few tools to help you keep your data secure even if a cybercriminal tries to target you, starting with a password manager.

NordPass is an intuitive password manager that ensures your login credentials are safe and only autofills them for you when it recognizes you’re on the right website. So, if you’ve got your bank password saved on NordPass and a scammer tries to get you to log in to a fake banking site, you won’t automatically log in by accident.

NordPass allows you to generate and store strong and unique passwords for your new and existing accounts, letting you quickly update any login credentials that might have been compromised. You can also use the Data Breach Scanner to check whether your password or credit card details have appeared on the dark web and take action to update your old credentials.

Sharpen your awareness of digital scams and keep your data safe with NordPass.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.