Recognizing phishing: how to read a link and a sender
Phishing is a message that poses as a trustworthy sender, so that you do something you wouldn't otherwise do: log in to a fake page, open an attachment, hand over a code, or make a payment. Spelling mistakes are no longer a good indicator: with AI, scammers write flawless Dutch. So look at three things: where the link really goes, who the real sender is, and what the message is asking of you.
Does the email appear to come from WebOké? Then read Is this email really from WebOké? Recognising phishing and using the promo code. In the examples below we use made-up names ending in .example.
Reading a link
Hover your mouse over the link without clicking; the real address appears at the bottom of the window. On a phone, press and hold the link. Only that address counts, not the text on the button.
- Find the part between
https://and the first/. That is the host: the server you're being taken to. Everything after the first/is chosen by the owner of that host. - Is there an
@in that part? Then the host only starts after the@. - Read the host from right to left. The registrable domain is the extension plus one word before it, for example
mijnbank.example. That is the name someone has registered, and therefore the owner. Everything to the left of that is subdomains, which the owner makes up themselves. Watch out for two-part extensions, such asco.uk: forwww.shop.voorbeeld.co.ukthe registrable domain isvoorbeeld.co.uk.
| Link | Real owner | What's going on? |
|---|---|---|
https://inlog.mijnbank.example/klant | mijnbank.example | Fine: a subdomain of the bank itself |
https://mijnbank.example.inlog-check.example/login | inlog-check.example | Subdomain trick: the real name is at the front |
https://inlog.example/mijnbank.example/login | inlog.example | Path trick: the name appears after the first / |
https://mijnbank.example@aanvaller.example/ | aanvaller.example | @ trick: everything before the @ doesn't count |
https://rnijnbank.example/ | rnijnbank.example | Lookalike: rn looks like m |
https://mijnbank-veilig.example/ | mijnbank-veilig.example | An extra word: a completely different domain |
https://xn--mijnbnk-6fg.example/ | xn--mijnbnk-6fg.example | Punycode: a character from a different script |
A lookalike resembles the real domain: letters swapped around, an extra word or hyphen, or a character from a different script (a Cyrillic а looks like a regular a). Such a name with unusual characters appears technically as punycode, which starts with xn--. In a name that otherwise looks like normal Dutch, that's suspicious.
Shortened links, redirect links and QR codes
- A shortened link doesn't show the destination. If a bank or supplier asks you to log in via such a link, don't do it.
- A link can start at a real site and then redirect you. After clicking, check the address bar again before entering anything.
- A QR code is a link you can't read. Let the camera show the address first and read it. Watch out for stickers placed over a genuine code, for example on a parking meter.
- The padlock icon only indicates that the connection is encrypted. Fake sites have a padlock too.
Reading the sender
- The display name means nothing. Anyone can set their display name to "Mijnbank Customer Service", your director's name, or even an email address. Click or tap the name to see the real address and read its domain just like with a link.
- Check the reply-to address. With a Reply-To, your reply goes to a different address than the sender. Before you hit Send, check who your reply is really going to, especially if money or data is involved.
- A sender can be spoofed, and a genuine sender can be hacked. The header lines of an email show whether the domain actually sent the mail. But even a successful check only proves the mail comes from that domain, not that the domain can be trusted. How to read this is explained in Viewing and reading the header lines (headers) of an email.
Text message, WhatsApp and phone
A sender name or phone number on your screen can be spoofed, even if the message appears among genuine messages from your bank. Get a message from "a colleague with a new number" who urgently wants something paid? Call the old, known number. Does someone call on behalf of the bank or a helpdesk and ask for a code, a payment, or remote access to your computer? Hang up and call back yourself on a number you already had. Did you receive a login code or notification you didn't request yourself? Don't approve anything and change that password.
If it concerns an invoice or a changed account number, read Recognising a fake invoice, changed account number, or CEO fraud.
Not sure? Stop, check, ask
- Stop. Urgency, fear, or a reward is exactly the moment not to click.
- Check via your own route. Don't continue via the message. Type the address yourself or use your bookmark, and call a number you already had.
- Ask a colleague, or the sender via a different channel.
Report a phishing email to the Fraud Helpdesk: preferably forward it as an attachment to valse-email@fraudehelpdesk.nl and cc the company being impersonated. Report a text message or WhatsApp message via the report form. See Report a fake email.
More examples are provided by the NCSC in How do I recognise a phishing email?, SMS phishing and How do I recognise a fake phone call?.