SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/sec-shortened-urls

Why does CISA call untrusted shortened URLs a phishing warning sign?

They hide where the link really goes.

Start playing free

  1. They always contain a virus
  2. They hide the real destination of the link ✔
  3. They only work on phones

Why: A short link hides the full web address, so you cannot judge it before you click. Treat short links from unexpected messages with suspicion.

Huh, didn't know that: Many real services use short links too, so the risk comes from unexpected messages.

The dad joke
Why can you never trust spiders? Because they post stuff on the web.
Like this card?
Play the game

References

Answer: They hide the real destination of the link. A short link hides the full web address, so you cannot judge it before you click. Treat short links from unexpected messages with suspicion.

  1. CISA: Recognize and Report Phishing www.cisa.gov/secure-our-world/recognize-and-report-phishing
    Untrusted shortened URLs
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyCISA gives amazan.com as an example of what phishing red flag?Security & PrivacyThere's a QR code sticker on the parking meter. What's the smart move before you pay?Security & PrivacyA website shows a padlock and https. What does that tell you?

That's stuff everyone should know.