Practical guide
Do Not Let a Short Link Choose Your Next Sign-In
Handle unexplained redirects in private messages without trying to prove trust from a tiny URL.
Ask for the destination in ordinary language
A short link in a private message may be convenient, but it gives you little context by itself. Ask what service or page it opens and why you need to visit it. A reasonable answer might be the public page for an event you discussed. An answer that keeps changing, or refuses to name the destination, leaves the original question unresolved. The aim is not to condemn every short link. It is to keep an unfamiliar link from quietly taking control of an account task.
Separate a recommendation from a login request
Someone can recommend a page without needing access to your account. If opening their recommendation suddenly becomes a demand to sign in, provide a code, or reconnect an account, stop and reconsider the task. In a hypothetical conversation, a person promises a public profile preview but sends you to a credential form. That is a meaningful change in scope. You can return to the service through its known address and look for the material there instead of continuing through the supplied path.
Avoid creating another disclosure while checking
Be cautious about pasting a private link into an unrelated public tool just to inspect it. The link itself might contain a reference meant only for you, even if you cannot tell from its appearance. Ask the sender for a public destination or consult the relevant service through a trusted route. The FTC's phishing guidance favors independently known contact information over the information in a suspicious message. Apply that principle without sending the questionable link to an expanding list of third parties.
Use a clear boundary instead of an argument
A simple reply such as Please send the public page name; I will open the service myself keeps the exchange practical. You do not have to explain every security concern or accuse the sender of wrongdoing. If they pressure you to use only their link, the task can end there. Where reporting is appropriate, preserve the message context and use the platform's reporting channel. The outcome you want is an intentional destination, not a successful tour through every redirect someone places in front of you.
Sources checked
Linked reference pages checked on 2026-09-09. Product details can change. No paid-membership test or sponsorship is implied.
FTC: verifying suspicious messages independently ↗