The email looks like it is from the shop: a logo, an order number, a button that says “check delivery”. You hover the cursor over the button, or you hold it on the phone, and a long address pops up at the bottom. The shop’s word is in it, but the line starts somewhere else entirely. That is not a reason to press and “just look”.
You need to compare the domain: the piece of the address you yourself would type in the bar to reach the shop. Everything to the left, or hidden in a long tail, can be someone else’s site. The order still opens calmly in the shop app, or on a site you typed by hand.
What happens
In an email the sender’s name can be drawn as anything. Look at the mail address beside it, but even a familiar name in the address does not make the button honest. The main check is where the link goes, not the picture in the header.
The domain is the part after https:// and before the next slash. For a real shop it is short and familiar, the same one that is on the box, in the app, and on the receipt. If you always open the shop as primer.example, and the link goes to primer.example.other-address.example or to other-address.example/primer, those are different places. The shop’s word in the middle of a long line does not turn it into the shop.
On a computer you can see the domain if you point at the link and do not click. The address appears at the bottom of the window or in a popup hint. On the phone, a long press on the link often shows the address before you go there. If there is no hint, do not press. Open the shop separately.
Letters are sometimes similar: one is replaced by a neighbor, a hyphen is added, an extra digit is there. Reading a line like that in a hurry is hard, so it is more reliable not to compare “by eye with the picture”, but to remember the address you use yourself and type it. A bookmark you saved earlier is fine too. A link from today’s email is not.
Short addresses, such as shortened links, hide the real domain until you go there. You do not need them in an email about an order. A shop you open yourself opens without a chain of someone else’s short names. You do not need to take that chain apart piece by piece: simply do not follow it.
Do not enter a payment, an SMS code, or the full card number on a page you reached from the email. The bank and the shop give their own app or a site you opened yourself for that. If the order is real, it is visible in your account without the button from the email.
On the phone a long address is often hidden behind the button. Hold it and read the line up to the first slash, without letting your finger go into a normal tap. If the page already opened, enter nothing into it and close the tab. You will check the order later by typing the shop yourself.
What to check, in order
- Do not press the button in the email. First look at the link address: on a computer hover the cursor, on the phone hold the link if an address pops up.
- Find the domain: the piece right after https:// and before the first slash. The rest of the path tail is not the main thing yet.
- Compare that domain with the address you type yourself when you go to the shop. If it matches in full, that is closer to the matter, but it is still calmer to open the order with your own sign-in.
- If the shop’s word sits in the middle, another domain is to the left of it, or the ending is different, do not open the link.
- Open the shop yourself: the app on the phone, or an address typed by hand. Look at the order there.
- Look at the email sender’s address separately. An unfamiliar mailbox with a familiar picture is another reason not to press the button.
- Do not enter a code from a message, a password, or card details on a page from the email. A real shop does not ask for that through a random link.
- An email where the address did not match can be left alone or moved to spam. Do not forward it to people you know with “take a look”: they will press the same button.
Where people usually go wrong
- They look only at the logo and the word “order”, and do not read the address line.
- They are glad the shop’s word is somewhere in the link, and they do not look at which domain sits right after https://.
- They press a short link because “it looks neater”, and they do not see the domain before they go there.
- They enter a card on a page that opened from the email, even though they did not type the shop themselves.
- They forward the email into the family chat, and someone else opens the link.
Compare the domain you would type yourself with the domain in the link. The shop’s name in a long address is not yet the shop’s site. Do not go there from the email.
What to do today
Open the doubtful email, but do not press the button. On a computer, hover the cursor over the link. On the phone, hold it and read the domain right after https://. Match it to the address you use yourself. If there are extra words, a different ending, or a short link without the familiar domain, close the email and open the shop with the app or by typing the address. The order, if it is yours, will be in the account. Do not leave a code, a password, or a card on a page from the email. Do not forward an email like that to relatives.
A similar button often arrives in an SMS too. There is a text about a link that asks you to confirm a payment. You can check the shop itself before an order separately, as in the note on how to check an online shop.
