The Importance of Checking Shortened URLs

Why short links deserve a second look

You've almost certainly clicked one this week. A text about a parcel, a link in a group chat, a "read more" on social media: many of them look like bit.ly/3kQx7Zp or tinyurl.com/yb4n2m8r. These are shortened URLs, and they're everywhere.

A URL (Uniform Resource Locator) is simply a web address, the thing you type into your browser's address bar. Shorteners turn a long, messy address into a tidy little link that fits in a text message or a social media post.

The catch is that a short link hides where it's going. bit.ly/3kQx7Zp could lead to a recipe, your bank's real website, or a fake login page built to steal your password. You simply can't tell by looking at it.

The good news is that checking a short link takes only a few seconds once you know how. This post explains what short links are, why criminals like them, and the simple habits that keep you safe.

What a shortened URL actually is

A URL shortener is a website that keeps a big list matching short codes to long addresses. When you create a short link, the service stores something like this:

When someone clicks the short link, their browser goes to the shortener first. The shortener looks up the code and sends back a redirect, an instruction that says "the page you want is actually over here". Your browser then jumps to the real address, usually so quickly you never notice.

Behind the scenes, that redirect looks roughly like this. The 301 is an HTTP status code, a three-digit number a web server sends to say what happened; 301 means "moved permanently", and Location holds the real address:

HTTP/1.1 301 Moved Permanently
Location: https://www.example.com/blog/2026/11/winter-garden-planting-guide

Why people use them

• Space: they fit neatly into text messages, printed flyers and social posts.
• Tidiness: they hide long tracking codes such as ?utm_source=newsletter.
• Statistics: the shortener can count clicks, so businesses use them to measure campaigns.
• Branding: some organisations use their own short domains, such as nyti.ms for The New York Times.

Shorteners also come and go. Google's own shortener, goo.gl, stopped making new links back in 2018–2019, and Google switched off the inactive old links in August 2025. If you have old goo.gl links in documents or web pages, it's worth replacing them with the full address.

Why scammers love short links

Anyone can create a short link pointing anywhere, usually for free. That's handy for honest people, and just as handy for criminals.

Phishing

Phishing is when a scammer pretends to be someone you trust, such as a bank, a delivery company or a government agency, to trick you into handing over information. A fake page at auspost-redelivery.top would look suspicious in a message, but hidden behind bit.ly/… it looks no different from a genuine link.

Phishing by text message has its own nickname: smishing (SMS + phishing). Short links are especially common here because text messages are short.

Malware

Malware (malicious software) is any program designed to harm your device or spy on you. A short link might promise a photo, an invoice or a "missed delivery" form, but instead lead to a download or a page that tries to install something nasty.

Scams and fake shops

Short links are also used for fake online stores, too-good-to-be-true investment offers and "you've won a prize" pages. The aim is the same: get your money or your personal details, which can then be used for identity theft (someone using your details to pretend to be you).

Links that change after you've checked

Some shortening services let the link's owner change where it points later. A link that went somewhere harmless yesterday could point somewhere dangerous today. That's another reason to check a link at the moment you're about to use it, not just once.

How to read a web address

Unshortening a link is only useful if you can tell whether the real address is trustworthy. Here's a quick lesson in reading one.

Find the real domain

The real domain is the bit just before the first single forward slash (/) after the https://. Read it from right to left. Compare these two:

https://auspost.com.au/track/details          ← domain is auspost.com.au
https://auspost.com.au.parcel-check.info/track ← domain is parcel-check.info

The second one starts with "auspost.com.au", but that's just a made-up subdomain. The real owner is parcel-check.info, which has nothing to do with Australia Post.

Watch for lookalikes

• Swapped characters: paypa1.com (number one) instead of paypal.com, or rn pretending to be m.
• Extra words: commbank-secure-login.com is not the same as commbank.com.au.
• Odd endings: a government service in Australia will use .gov.au, not .com, .top or .xyz.

How to check a short link before you click

You don't need special skills for this. Pick whichever method suits the device you're on.

1. Hover or long-press (and know its limits)

On a computer, rest your mouse pointer over a link without clicking; the address appears in the bottom corner of your browser or email program. On a phone, press and hold the link to see a preview.

This is great for spotting when the link text says one thing (say, "www.mybank.com.au") but the actual link goes somewhere else. With a short link, though, hovering usually shows you only the short address, such as bit.ly/3kQx7Zp, not the final destination. So hovering is a first step, not the whole check.

2. Use the shortener's own preview

Several popular shorteners have a built-in preview page that shows the destination without taking you there. Copy the link, paste it into your address bar, make the small change below, then press Enter.

To copy a link without opening it: on a computer, right-click it and choose Copy link (or Copy link address). On a phone, press and hold, then choose Copy. Paste with Ctrl + V on Windows, Cmd + V on a Mac, or long-press and choose Paste on a phone.

3. Use a link expander

A link expander (or unshortener) follows the redirects for you and shows the final address, without your browser ever visiting it. It works with almost any shortener, including ones that have no preview trick.

Paste the short link into ExpandURL and you'll see where it really leads. If you check links often, the ExpandURL browser extension lets you do it straight from the page you're on.

This is also important because a link can bounce through several redirects in a row (a redirect chain), for example from a short link to a tracking service to the final page. An expander shows you the end of the chain, which is the bit that matters.

4. Scan the destination

Once you have the real address, you can check it against lists of known dangerous sites. Free tools such as Google Safe Browsing's site status checker and VirusTotal let you paste an address and see whether it's been reported. A clean result isn't a guarantee (brand-new scam sites may not be listed yet), but a warning is a clear "don't".

For the curious: checking from the command line

If you're comfortable with a terminal, the free curl tool can show you the redirect without loading the page. The -I option asks only for the headers (the server's reply information), not the page itself:

curl -I https://bit.ly/3kQx7Zp

Look for the Location: line in the reply. That's where the short link points.

Common situations and what to do

Most risky links arrive in a handful of familiar ways. Here's how to handle each one.

Simple habits that help

1. Pause on urgency. "Act within 24 hours" is a pressure tactic. Real organisations rarely threaten you by text.
2. Go direct. If a message claims to be from a company you deal with, ignore the link and go to its website or app yourself.
3. Keep things updated. Install updates for your phone, computer and browser promptly; they fix security holes that malware relies on.
4. Turn on two-step login. Also called multi-factor authentication, it means a stolen password alone isn't enough to get into your account.

Oops, I already clicked it

It happens to careful people too. Clicking a link is often not the disaster; what you do next matters most. Work through these steps:

1. Close the page. Don't enter anything, and don't open any file it downloaded.
2. If you entered a password, change it straight away on the real website, plus anywhere else you use the same password.
3. If you entered bank or card details, call your bank immediately using the number on the back of your card or on its official website.
4. If something downloaded, delete it and run a scan with your security software.
5. Report it. In Australia you can report scams to Scamwatch and cybercrime to ReportCyber via cyber.gov.au. If your identity details were taken, IDCARE offers free support.

Reporting helps more than you'd think. It can get scam sites taken down and warn others before they click the same link.

Quick reference glossary

Wrapping up

Shortened URLs are genuinely useful, and most of the ones you meet are harmless. But because they hide their destination, they're also a favourite tool for scammers. A few seconds of checking puts you back in control.

If you remember four things, make them these:

1. A short link hides its real destination, so you can't judge it by looking.
2. Reveal the destination first, using a preview trick or a link expander like ExpandURL.
3. Read the real domain from right to left; the padlock doesn't prove a site is safe.
4. Never log in, pay or share details through a link in a message. Go to the official site or app yourself.

Peek before you click, and short links lose most of their power to surprise you.