URL

How it works

• The part that matters is the domain just before the first single slash.
• Fakes use lookalikes such as micros0ft.com or a real name placed in front of a different domain.
• On a computer, hover over a link to see the real destination before clicking.
• When unsure, type the address yourself.

What can go wrong (example scenario)

A three-person bookkeeping firm clicked a link reading microsoft365-billing-update.com in an email about an expiring subscription. The page looked like Microsoft. The password they typed went straight to a scammer, and the mailbox was used to send fake invoices to their clients.

How WILDCARD handles it

Domain Security protects your own domain from being hijacked or spoofed. For links coming in, Email Security and Phishing Training watch and teach.

• A dental office's booking link goes on cards and reminders. The URL needs to be short, correct and on the office's own domain.
• A law firm teaches staff to hover over links and read the domain before clicking anything about a court filing.
• A retailer's customers get a receipt link. If it points to a third-party domain, customers learn to trust the wrong address.

Example scenario: A staff member at a small non-profit received a “shared document” email. The link's domain was sharepoint-online-files.net. She read the address, saw it was nothing like the organization's real Microsoft domain, and reported it. The same message reached two board members who clicked it.

A question owners ask

What is the quickest way to tell if a link is safe?

Find the registered domain, the part just before .ca or .com, and ask whether you know it. If you are unsure, type the address you know into the browser instead of clicking.