Back

Don’t make dangerous links look trustworthy

Sviatoslav Nytka
Sviatoslav NytkaSenior Product Designer at TechMagic
TLDR: A link inside a product can feel trusted by default. But the person who sent it may not be. A scammer can send a link that looks safe but points somewhere else, or move the conversation outside the product entirely. Good UX should warn users early, explain what happens when they click, and block or flag links that are already known to be suspicious.

A message inside any familiar product feels different from a random message on the internet. The user already trusts the product. They know the interface, recognize the logo, and assume the conversation is happening in a controlled environment. But the platform doesn’t necessarily know whether the person sending it is trustworthy.

The problem gets worse when the link itself is misleading. A message can visually show www.airbnb.com, while it is just a text linked to www.scam.com. The user sees one destination and gets sent to another. On a desktop, they might notice the real URL by hovering over it. On mobile, there may be no equivalent moment to inspect the destination before opening it.

The external links warning helps prevent security risks. It informs users before redirecting to external websites and provides clear explanations and guidance.

Victoria Shutenko
Victoria ShutenkoSecurity Engineer at TechMagic

Link protection works best as a layered system. The product can check URLs against threat-intelligence feeds and reputation databases, inspect redirect chains, and compare the visible link text with the actual destination. It’s also useful to consider signals such as newly registered domains, suspicious URL patterns, and domains that have been reported for phishing or abuse.

Of course, not every product has the resources to build or maintain these detection systems. The good news is that you can still prevent many attacks with simple UX patterns that warn users at the right moment.

What good UX looks like

  1. Warn users before they need to think about links. It can be shown when a conversation starts, near the message composer, or as a small banner at the top of the thread.
  2. Explain the real destination when the user clicks. Don’t immediately throw the user onto another website, show the real URL. This becomes even more important when the visible text doesn’t match the real destination.
  3. Don’t wait for the user to discover a bad link. Products that allow user-generated content should maintain a reputation system for links. When someone sends a message containing a link, the system can check the destination against known malicious domains, phishing databases, previous reports, and other security signals.
Booking. A persistent warning reminds users not to click suspicious links or respond to unusual messages while communicating with another person.
Temu. A security reminder stays visible across the product, warning users about scam messages and links and reminding them that the platform won’t ask for extra fees via SMS or email.
Slack. A link warning shows the real destination before the user leaves the product and gives them a clear choice to go back or continue.
Tripadvisor. A link warning shows the real destination before the user leaves the product and gives them a clear choice to go back or continue.
LinkedIn. A prominent warning tells users that the destination has been classified as malicious and recommends not opening it.
Microsoft 365. A prominent warning tells users that the destination has been classified as malicious and recommends not opening it.

Bottom line

Products where people communicate with each other should treat user-generated links as untrusted content by default. Warn users before they leave, show the real destination at the moment of interaction, and use link reputation to block or flag known threats.