How can I tell if a link is a phishing link?

Read the domain immediately to the left of the first single slash, and ignore everything else in the URL. That is the only part that determines who actually receives what you type. Then ask whether you were expecting this message, whether it is pressing you to act quickly, and whether the request makes sense from that sender. Urgency plus an unexpected login page is the most common combination.

Is a link that says it will self-destruct a scam?

Not necessarily. One-time secret links genuinely do delete themselves after being read, and they are a normal way to send a password or key. The problem is that this behaviour looks exactly like a phishing tactic, so verify the link the same way you would any other: confirm with the sender through a different channel that they sent it, and never enter your own password into the page it opens. A real secret link shows you something. It does not ask you to log in.

Can you get hacked just by clicking a link?

In most cases the damage needs a second step from you, such as typing a password, entering a login code or approving a prompt. Simply opening a page is usually not enough. It is not impossible, because browsers do occasionally have flaws that a page can exploit, which is why keeping your browser updated matters. The realistic risk is what you do on the page, not the click.

How do I check a link without opening it?

On a computer, hover over the link and read the address your browser shows at the bottom of the window. On a phone, press and hold the link until a preview appears rather than tapping it. Both show you the real destination, which is often different from the text displayed in the message.

What should I do if I clicked a phishing link?

If you only opened the page and typed nothing, close it and you are very likely fine. If you entered a password, change it immediately on the real site, and change it anywhere else you reused it. If you entered a login code as well, treat the account as compromised: sign out all sessions, check for new recovery addresses or forwarding rules, and tell whoever runs the account if it is a work one.

What is a phishing link? How to check before you click

A phishing link is a URL that impersonates a service you trust, so that you will hand over a password, a payment detail or a login code. The link itself steals nothing. It opens a page built to look like the real one, and the theft happens in the moment you type something into it.

That distinction matters, because it tells you where to be careful. The click is rarely the dangerous part. What you do on the page that opens is.

Read the domain, and ignore the rest

Nearly every trick in phishing is an attempt to make you look at the wrong part of a URL. There is only one part that decides where your data actually goes: the domain sitting immediately to the left of the first single slash.

https://accounts.google.com.verify-login.net/signin
                            \______________/
                            the real destination

https://accounts.google.com/signin?ref=verify-login.net
        \_________________/
        the real destination

The first is not Google. google.com appears in it, but only as a label in front of the domain that actually receives the request, which is verify-login.net. The second genuinely is Google, and the suspicious looking text after the question mark cannot change that.

Read right to left from that first slash, and stop at the second dot. Everything before it is decoration that anyone can set to anything.

The signs worth checking

No single one of these proves anything. Two or three together are worth acting on.

You were not expecting it. The strongest signal there is. An unprompted message about an account problem deserves suspicion however well made it looks.
It is in a hurry. Suspension notices, expiring access, a delivery that will be returned. Urgency exists to stop you checking.
It asks you to log in. Legitimate services usually tell you to go to their site yourself. A link that lands directly on a password field is the classic shape.
The displayed text is not the destination. Hover on a computer, press and hold on a phone. If the text says one thing and the address preview says another, that gap is the entire attack.
Lookalike characters. A zero for an O, rn for m, an added hyphen. These are invisible at a glance and obvious once you are reading deliberately.
It wants a code. No legitimate support desk asks you to read back a login code. Anyone asking is trying to get past a security check on your account right now.

One thing that is not a sign: the padlock. It means the connection is encrypted, not that the site is honest. Phishing pages have padlocks too, and they always have.

Why legitimate secret links look suspicious

There is an awkward overlap here worth naming, because it affects anyone who sends credentials as part of their job.

A one-time secret link is a normal way to send someone a password or an API key. It carries the secret, shows it once, and deletes it. But look at how that behaves from the recipient side: an unfamiliar domain, a long opaque URL, a message telling them to open it promptly, and a page that destroys the evidence after a single view.

That is close to a phishing checklist. Recipients are right to pause, and the good ones do. So the answer is not to persuade people to worry less. It is to send the link in a way that survives the check.

How to verify a secret link someone sent you

If a colleague or supplier sends you a self-destructing link, three things settle it:

Confirm through a different channel. If it arrived by email, ask in chat or by phone. This is the whole point of out-of-band verification: an attacker who controls one channel almost never controls two.
Check what the page asks of you. A genuine secret link gives you something. If it asks for your own email password, your card details or a login code, it is not a secret link whatever it claims to be. A passphrase prompt is normal, but that passphrase should be one the sender told you separately, never a credential of yours.
Expect it to break. Because these links work once, a secret that has already been viewed when you open it is real information. Either a scanner fetched it or somebody else got there first. Say so, and get the credential rotated.

If you are the one sending

You can remove most of the doubt before it arises, and it costs one extra sentence.

Say it is coming, before it comes. A short heads-up in another channel turns an alarming link into an expected one.
Send it from somewhere they already know you. A first ever email from an unfamiliar address carrying an urgent link is indistinguishable from an attack.
Name what is inside. "This is the staging database password we discussed on Tuesday" does work that no amount of link formatting can.
Never ask for a credential in return. If your process requires the recipient to send a password back, you have trained them to do the exact thing phishing relies on.

If you already clicked

Clicking and immediately closing is very rarely a problem. What matters is whether you gave the page anything.

You typed nothing. Close the tab. You are almost certainly fine.
You entered a password. Change it on the real site now, going there yourself rather than through any link. Change it anywhere you reused it, which is the part people skip and the part attackers count on.
You entered a login code too. Treat the account as compromised. Sign out every session, check for recovery addresses, forwarding rules or app passwords you did not add, and tell whoever runs the account if it is a work one.
You approved a prompt on your phone. Same as above. Approving is the same as handing over the code.

Reporting it matters more than it feels like it does. Phishing arrives at an organisation in waves, and you are rarely the only recipient. Being the person who says so early is worth considerably more than being the person who quietly got away with it.