Last spring, I got a WhatsApp message from an unfamiliar number. It said I had been picked for a prize draw and had 24 hours to claim a new phone. I was bored and tired, so I tapped the link anyway.
The page loaded slowly, then a banner popped up. It greeted me by my city, named my exact phone model, and even mentioned my mobile network. I had not typed a single thing.
My stomach dropped. A stranger’s page already knew roughly where I was and what I was holding. I closed the tab, put the phone face down on the couch, and sat there feeling silly, then annoyed, then curious.
So I spent the next few weeks reading, testing safe links on my own devices, and pestering a cousin who works in IT. Here is what I learned.
What a Link Can Learn When You Click It
First, a reassurance. Tapping a link does not usually hand a stranger control of your phone. It sends a request to a server, and that request carries more details than most people realize.
Your IP address is the big one. Your internet provider assigns it to your connection, and it points to your approximate location and provider. It does not reveal your street address, but it is close enough to make a scam message feel personal.
Your browser also introduces itself. It shares the browser name and version, your operating system, and your device type, which is how that page knew my phone model. The server also records the exact time of your click.
That timestamp matters more than you would think. If one link goes out to thousands of people, the scammer sees who opened it and when. Those people get targeted again.
How Link Tracking Works in Plain Language
Think of a tracked link as a doorbell with your name on it. The sender adds a unique code to the end of the address, and that code belongs only to you. When you ring the bell, the server writes down the code along with everything your device announced at the door.
Marketers use the same idea to see whether a newsletter got read. Scammers use it to sort active phone numbers from dead ones.
Some links also bounce you through a shortener or a chain of redirects. You tap once and land somewhere else, and every stop can log your details. You never see any of it happen.
The tracking alone is rarely the real damage. The damage comes after, when the sender knows your number is live and your city is nearby. Their next message gets much more convincing.
Real Situations Where People Get Tracked
Once I started talking about this, everyone had a story. A friend got a message from a stranger asking, “Is this you in this photo?” with a link attached. A relative got a fake courier notice saying a parcel was held until a small fee was paid.
The pattern is always the same. A message from an unknown sender, a sense of urgency, and a short link that hides the real destination. Fake prizes, blocked bank accounts, and missed deliveries are the three I see most.
Phishing pages add one more step. They copy a real login screen, log your click, and then ask for your password or card details. Mine never got that far, but my uncle’s did, and cleaning it up took him a week.
How I Check a Link Before Tapping
My rule now is simple. If I did not expect it, I do not tap it. When a link might be legitimate, I check it first.
On Android, I press and hold the link instead of tapping. That lets me see or copy the full address. I trust the address, never the words around it.
Then I paste it into VirusTotal, which is free and checks the address against dozens of security engines. URLVoid does something similar by comparing a site against several reputation lists. Both take under a minute.
I learned one lesson the hard way. A clean result does not always mean safe, especially for a page created an hour ago. If a stranger sent it and it pushes urgency, I skip it, whatever the scanner says.
Using Link Previews Without Opening Anything
WhatsApp and other messaging apps often show a small card with a title and image under a link. That card is usually built by the sender’s app before the message goes out, so seeing it does not mean your phone visited the page. It gives you a quick look at where the link points.
Do not trust it blindly, though. Scammers can set a convincing title and picture, and some links show no preview at all. I treat a missing preview as a red flag.
My habit is to hold my finger on the link, copy it, and paste it into a scanner. Never tap just to see what happens. That one habit would have saved me my bad evening.
Where a VPN Fits In
A VPN sends your traffic through another server, so the sites you visit see the VPN’s IP address instead of yours. That hides your real IP and approximate location from a link’s server. When I tested with a safe link of my own, it showed a completely different city.
It is a useful layer, not a shield. A VPN will not stop you from typing your password into a fake page. It will not remove a bad file you download either.
Pick a provider with a clear privacy policy and a solid reputation. I once installed a random free VPN without checking, and all it did was flood my phone with ads. Free services with no clear business model can end up collecting more data than they hide.
What to Do If You Already Clicked
Do not panic. In most cases, a single click only shared the basic details we covered. A few steps are still worth taking right away.
Close the tab and enter nothing. If you already gave a password, code, or card number, change that password immediately and call your bank if payment details were involved. Turn on two-factor authentication for your important accounts.
Then check your downloads and installed apps for anything you did not choose. Open Google Play Protect in the Play Store and run a scan. In Chrome settings, look at site notifications and remove anything unfamiliar, because some scam pages trick you into allowing alerts.
Clear your browser cache and cookies, block and report the sender, and watch your accounts for a couple of weeks. Expect a few more odd messages, since your number may now be marked as active.
I still get strange messages now and then. The difference is that I pause, press and hold, and check before I tap. That ten seconds costs nothing, and it beats the sinking feeling of seeing a stranger’s page say hello to you by name.
If a friend forwards you something exciting from an unknown sender, send them this article instead.