How to check a link before you log in to a crypto exchange

Phishing messages work because they arrive when you are busy. A text claims your account needs attention, a chat message says a withdrawal is pending, and the link looks almost right. The moment you type your email and password, the attacker has both. This guide sets out a repeatable way to check a link before you log in to a crypto exchange account, using only the exchange help centre and your own account settings as reference points. It is written for readers in Bangladesh who receive such messages on mobile data or Wi-Fi and often open them on a phone, where the address bar is short and easy to misread. The goal is not to memorise a list of bad links, because those change constantly. The goal is to build a short routine: pause, inspect the destination, compare it with what you already know, and only then decide whether to continue. If any step cannot be completed, you stop and reach the platform through a route you chose yourself.

Why the link in the message is the weakest point

A login link in a message is a claim, not a fact. Anyone can write a sentence that looks like a security notice, copy a logo and send it to thousands of numbers. The message does not prove who sent it, and the visible text of a link is not the same as the destination it opens. On a phone this is worse: the address bar may be truncated, the keyboard covers part of the screen, and a quick tap can load a page before you have read anything.

Attackers rely on that speed. They want you to act while you feel a small amount of pressure, such as a warning about unusual activity or an expiring session. Your defence is to remove the time pressure from your side. Treat every unsolicited login link as unverified until you have checked where it actually goes, and remember that a genuine platform notice does not become less genuine because you took two extra minutes to open the site yourself.

The practical consequence is simple. Do not log in from a link you did not request. Open the platform through a method you already trust, such as a bookmark you saved earlier or the app already installed on your device, and then look for the same notice inside your account. If the notice is real, it will be waiting there.

Reading the destination before you tap

Before tapping, look at the full destination if your messaging app shows it. Long-press or use the preview option where available, and read the part closest to the beginning of the address rather than the end. Attackers often place a familiar word later in the address to create a false impression, while the actual destination sits earlier. If the preview is hidden or the app only shows a shortened form, that alone is a reason to stop and verify another way.

Once the page opens, do not touch the login form. Read the address bar first and check three things: whether the connection indicator is present, whether the address matches the platform you intended to visit, and whether the page asks for anything unusual at the login step, such as a seed phrase, a wallet password, a card number or a one-time code typed into the same screen as your password. A login page should ask for your login credentials and, at most, a second factor on a separate step.

If you are unsure, leave the page without entering anything. Open a new tab and reach the platform the way you normally do, then compare what you see. Differences in layout, wording, missing language options or a sudden request to re-enter everything are all signals to stop. When in doubt, close the tab entirely rather than trying to navigate away from a suspicious page.

Building a route you control and recording what you see

The most reliable check is not visual at all. It is having a route to the platform that you created yourself and that no message can change. Save the login page as a bookmark on your phone and computer, or keep the official app installed and updated through your normal app store. Then, whenever a message claims something needs your attention, ignore its link and use your own route. This removes the entire class of problems described above, because you never depend on the sender being honest.

Keep a short written record when you receive a suspicious message. Note the date and time, the sender number or address, the exact wording, and what the link appeared to point to. Do not click it to find out more. If you already tapped it but entered nothing, note that too, and consider clearing the browser session. If you did enter credentials, change your password immediately from your own trusted route, review active sessions and device authorisations in your account settings, and contact the platform through its help centre.

Use the help centre to learn how that platform describes its own security notices and what it says about verifying communications. The wording there is the reference you compare against. If a message uses urgent language, asks you to confirm something through a link, or offers an unexpected reward for logging in, treat it as unverified and check your account directly instead.

Common mistakes and clear stop conditions

A frequent mistake is judging a link by its visible text. The words shown in a message can say anything; only the destination matters. Another is trusting a message because it arrived in the same thread as earlier genuine messages, since senders can be spoofed or a chat account can be taken over. A third is entering credentials first and checking afterwards, which reverses the order that protects you.

Set stop conditions in advance so you do not have to decide while under pressure. Stop if the address does not match what you expect, if the page asks for a seed phrase or wallet password, if a login page requests a one-time code together with your password, if you are asked to install something to continue, or if the message pressures you with a deadline. In any of these cases, close the page, reach the platform through your own route and verify from inside your account.

Finally, do not rely on memory alone for fees, limits or account rules that a message might reference. Those details belong on the platform's official fee page and help centre, and they can change. Check them there when you need them, record what you find with the date, and never treat a number quoted in an unsolicited message as accurate.

Risk boundary: Bangladesh Crypto Guide

Digital assets are volatile and derivatives can amplify losses. This website has no login, wallet connection, deposit form or customer-support chat. A referral link only records attribution; it does not guarantee access, pricing, rewards, approval or investment results. Availability can differ by residence, legal entity and product, so no regional access is assumed from language or branding alone.

Scenario checkpoint

• Do not log in from any link you did not request; open the platform through a bookmark or the installed app instead.
• Before tapping, read the destination in the message preview and stop if it is hidden or shortened.
• On the opened page, check the address bar before typing anything and confirm the page asks only for normal login credentials.
• Stop immediately if a page requests a seed phrase, wallet password, card number or a one-time code on the same screen as your password.
• If you entered credentials, change your password from your own trusted route and review active sessions and device authorisations in account settings.
• Record the date, sender, wording and apparent destination of suspicious messages, and check the platform help centre for how it describes its own notices.