How to Spot Phishing Links in Chats

Phishing works because it looks normal: a courier update, a bank alert, a friend sharing "a video of you". Here's how to see through it.

#Red flags

- **Urgency:** "Your account will be closed in 24 hours." - **Too good to be true:** free phones, cash prizes, government grants. - **Requests for logins, OTPs or card details.** - **Odd domains:** `paypa1-secure.co`, `bank-verify-login.net`, long random strings. - **Shortened links** from people you don't know. - **Messages from a friend that don't sound like them.**

#Check a link before tapping

1. **Long-press** the link to see the full address. 2. Read the **domain** right before the first single slash — `bank.com.verify-me.xyz` belongs to `verify-me.xyz`, not your bank. 3. When in doubt, **open the official app or type the website yourself** instead of tapping.

#Never enter

- Passwords or one-time codes. - Card numbers or wallet PINs. - CNIC/ID photos.

…on a page you reached from a chat link.

#How Yapie protects you

- Chats from people you don't know land in **Requests**, where **links are disabled** until you accept. - You control **who can message you** and **who can add you to groups**. - **Report** suspicious messages so moderators can remove the account. - Two-step verification stops stolen passwords from being enough.

#If you tapped and entered details

1. **Change the password** immediately — and anywhere you reused it. 2. Turn on **two-step verification**. 3. Call your **bank** if you entered card or account details. 4. **End unknown sessions** in Settings › Devices.

#Frequently asked questions

How can I tell if a link is fake?

Check the real domain, watch for urgency or prizes, and never log in or pay from a chat link — open the official site or app yourself instead.

Are links from strangers clickable in Yapie?

No. In the Requests inbox, links stay disabled until you accept the chat.

What should I do after clicking a phishing link?

Change your password, turn on two-step verification, contact your bank if you shared payment details, and end unknown sessions.