Safety & privacy
Is It Safe to Click Links From Strangers?
Is it safe to click links from strangers? Not without checking first. A link from someone you just met in a chat can lead to a fake login page, a malicious download or a page that records your IP address, and it only takes one tap. Most links are harmless, but a stranger's link deserves a 30-second inspection before you open it, and many deserve no tap at all.
Here's why links are a favorite tool in chats, how to read one without opening it, and exactly what to do if you've already clicked.
Why links are the go-to scam tool in chats
A link moves you from a moderated chat to a page someone else controls. Once you're there, that page can pretend to be anything.
- Fake login pages that copy Instagram, Snapchat, your email provider or your bank and capture whatever you type.
- "Verify you're real" pages that ask for card details, a phone number or a selfie before you can "keep chatting".
- Downloads in disguise: a "photo", a game, a video player or a "private chat app" that installs malware.
- IP-logging links that record your IP address and approximate location the moment the page loads.
- Investment and giveaway sites that pull you into crypto or romance scams.
The message around the link is built to rush you: "is this you in this video?", "your account will be deleted", "only 10 minutes left". Urgency plus a link is the pattern to notice.
How to check a suspicious link from a stranger without opening it
- Don't tap yet. On a computer, hover over the link and read the real address that appears, usually in a corner of the browser window.
- On a phone, copy instead of opening. Press and hold the link, choose Copy, and paste it into a note to read it. On some phones the press-and-hold preview loads the page, so go straight to Copy.
- Find the real domain. Look at the part just before the first single slash after "https://". In "https://login.example.com/account" the domain is example.com. In "instagram.com.secure-login.xyz/verify" the real domain is secure-login.xyz, not Instagram.
- Look for lookalikes: swapped characters (rn for m, 0 for o), extra words or hyphens, and unusual endings.
- Treat shortened links as unknown. They hide the destination, so don't assume they're fine.
- If you really need to open it, paste the address into a reputable link-scanning service first. Several security companies offer free ones.
| What you see | Treat it as |
|---|---|
| The address doesn't match what the message claims | Phishing. Don't open it. |
| It ends in a file name like .apk, .exe, .zip or .dmg | A download. Don't open it. |
| A shortened link with no explanation | Unknown. Ask what it is, or skip it. |
| A well-known site you'd visit anyway, like a news story | Lower risk. Find it yourself through a search instead. |
| A page that asks you to log in, pay or enter a code | Stop. This is where the damage happens. |
When a link claims to come from a company, skip the link entirely. Open the company's app, or type its address yourself, and check from there.
What happens if you click a scam link
Clicking is usually less dangerous than what happens next. With an up-to-date browser, simply loading a page rarely infects a device. The real damage tends to come from three actions:
- Typing a password, card number or personal details into the page.
- Downloading and opening a file, or installing an app or profile the page offers.
- Granting permissions the page asks for, such as notifications, camera access or permission to install apps.
The exception is an IP logger, which does its job as soon as the page loads. It reveals your approximate area and internet provider, not your street address. Peer-to-peer video calls can share your IP with your chat partner anyway, so read what your IP address reveals on video chat if that worries you.
Clicked a suspicious link? What to do next
Match your next steps to what you did on the page.
You only opened the page
Close the tab and don't go back. If you allowed notifications or any other permission, remove it in your browser's site settings. Make sure your browser and operating system are up to date.
You typed a password
- Go to the real site by typing its address yourself and change the password right away.
- Change it anywhere else you used the same password.
- Turn on two-step verification, and sign out of other sessions if the account offers that option.
- Watch for "new sign-in" or "password changed" emails you didn't trigger.
You entered card or bank details
Call your bank or card issuer, or freeze the card in their app, and check recent transactions. If you lost money in the US, you can also report it to the FBI's IC3.
You downloaded or installed something
Don't open the file. Delete it, uninstall any app or profile you don't recognize, and run a full scan with your security software; on Windows, the built-in Windows Security works. If the device behaves strangely afterward, back up your personal files and consider a reset.
If you shared a code sent to your phone, treat it as urgent and follow the steps in someone asked for your verification code.
Links on Omlet's text chat
On Omlet, text chat sits right beside the video, and in-chat tips warn you about links, scams and threats when they come up. A warning isn't a verdict. It's a reminder to slow down and check.
- You never need to open a link to keep a conversation going. "Just look at this" is not a reason.
- If someone sends spam, ads or scam links, tap the flag on their video, choose "Spam, ads or scams" and press Report and skip. You move on right away.
- Someone you report is never matched with you again on that device.
For the bigger picture on how chat scams work, see common video chat scams. If a link or chat has already been used to collect and post your details, follow what to do if you get doxxed.
Habits that make bad links harmless
- Keep everything updated. Updates patch the security holes that malicious pages try to use.
- Use a password manager. It won't autofill your password on a lookalike domain, which works as a built-in phishing alarm.
- Turn on two-step verification for email and social accounts, so a stolen password alone isn't enough.
- Install apps only from your device's official source, never from a link in a chat.
- Say no to notification requests from sites you don't know. Spam notifications are a common follow-up to a bad click.