Check a suspicious link in Belgium

Received a suspicious link, website, QR code or URL by SMS, email or messaging app? Do not open it just to see. First check the domain, the brand name used, the requested action and the context: payment, login, code, download or urgency.

Understand / Check / Act

  1. Understand - What this scam is trying to obtain

    Check a suspicious link, URL, QR code or website in Belgium without opening it. Compare the domain with the official channel before acting.

  2. Check - The safe channel to open yourself

    5 useful official sources listed below.

  3. Act - The useful next step

    I already took action

Do you have the message in front of you?

Check a suspicious SMS, email, link or call with the fraud checker.

Open the checker

What to do now

  • Do not open the link and do not enter any data.
  • Only copy the link as text if you want to analyse it, without visiting the website.
  • Open the official app or website yourself and check whether the same request appears there.

Why a link may be suspicious

  • A link may include the name of bpost, itsme, Payconiq, a bank or a public service without belonging to that organisation.
  • The brand can appear in a subdomain, path or extra word. That does not make the domain official.
  • HTTPS means the connection to that domain is encrypted. It does not prove the domain belongs to the real organisation.

How to check safely

  • Read only the visible domain and the requested action.
  • Compare it with the official domain you open yourself, not with a link from the message.
  • If the link asks for card details, a code, identity document, payment or software installation, stop until official confirmation exists.

If you already clicked

  • Close the page and enter nothing else.
  • If you entered a password, change it through the official website.
  • If you shared card data, a code or banking access, contact your bank immediately and Card Stop if a card is involved.

Evidence to keep

  • Keep the message, visible URL, time, named organisation and screenshots.
  • Make links non-clickable before sharing them with someone else or in a report.
  • Do not publish personal data, codes, card numbers or identity documents.

Where to report

  • A phishing message with a link can be reported through the appropriate official channel, such as Safeonweb when relevant.
  • If a bank, payment, card or code is involved, contact your bank first through an official number.
  • For loss, threats or identity misuse, police may also be needed.

Limits of this page

  • This page does not prove that a message is safe and does not replace your bank, the police, Safeonweb, a platform or a public service.
  • A scam may be new, very well written or described with too little context. Use the result as decision support, not as absolute certainty.
  • Before taking a final action, checking through the official channel matters more than the appearance of the received message.

Check through an official channel

  • Type the service address yourself or open the official app. Do not use a phone number, link or QR code from the suspicious message to verify the situation.
  • When money, card details, a code or account access are involved, the safety action comes first. The analysis can then help organise the evidence.

How to read the result

  • A low number of signals does not mean that everything is safe. It only means that this page or analysis did not find decisive evidence with the information available.
  • Focus on the requested action: paying, sharing a code, installing an app, approving a bank action or leaving an official platform. That action matters more than a logo, sender name or polished wording.
  • If the situation feels urgent, step away from the received message first. Then check calmly through a channel you already trusted before the message arrived.

Belgian reading of this situation

  • For the suspicious link, focus on the relevant Belgian next step: open the official channel yourself, contact the bank, use Safeonweb or preserve evidence.
  • The right décision for the suspicious link depends on what has already happened. Reading a message is not the same as clicking, paying, sharing a code or granting remote access.

What to do now without panic

  • If the suspicious link worries you, choose the next step from the requested action: clicking, paying, sharing a code, installing an app, sending a document or approving account access. Do not rely only on the logo or sender name.
  • When the suspicious link involves an urgent, financial or hard-to-undo action, StopArnaques treats the situation as something that must be checked first. Polished wording, a familiar brand or a realistic amount does not make the request reliable by itself.
  • If you already acted in a case involving the suspicious link, the order matters more than the label: contact the bank, platform or official service first, preserve evidence next, then compare the situation with similar campaigns.

What can be legitimate

  • For the suspicious link, some notifications can be real: a delivery, invoice, administrative document, payment request, security alert or platform message. This is why this page does not claim that every similar message is automatically a scam.
  • The difference in a the suspicious link case is vérification. A real request should be visible through the app, portal, customer area or phone number that you open yourself, not only through a link, QR code or number included in the suspicious message.
  • If the official environment does not show the same request about the suspicious link, amount, référence or beneficiary, it is safer to stop and report or verify the case before continuing.

Limits and responsibility

  • For the suspicious link, StopArnaques helps explain signals and choose safer actions, but it does not replace your bank, the police, Safeonweb, the FPS Economy, a platform or the organisation concerned.
  • A result about the suspicious link may remain uncertain when the text is too short, when context is missing or when the fraud uses a new variant. In that situation, slow down, verify independently and avoid any irreversible action.
  • If the suspicious link involves a payment, code, card, identity document, itsme approval, banking app or remote access, the protective action comes first. Do not wait for a perfect label if harm may already be possible.

Keep evidence and report

  • For the suspicious link, keep the message, date, channel, visible sender, neutralised link and useful screenshots. Do not publish personal data or clickable suspicious links on social media.
  • Report the suspicious link to the relevant channel when appropriate, for example Safeonweb for suspicious messages, the platform for account abuse and your bank when money or payment details are involved.
  • This evidence about the suspicious link can also help link a campaign to a case later without storing raw personal data. That matters if the system is to improve without exposing users unnecessarily.

Frequently asked questions

Can I check a suspicious link without opening it?

Yes. Look at the domain and requested action, or analyse the link as text. Then open the official service yourself through its app or website.

Is an HTTPS site always trustworthy?

No. HTTPS secures the connection with the visited domain, but does not prove that this domain belongs to bpost, itsme, Payconiq, a bank or a public service.

What if the brand name appears in the URL?

Check whether the brand name is in the real official domain. A name in a subdomain, path or added word can be misleading.

What should I do if I already entered data?

Contact the affected service through an official channel. If banking data, a card or a code is involved, call your bank immediately.

Useful official sources

Transparency and Sources

Last updated
2026-09-10
Latest recorded source check
2026-09-17
Content status
information published with visible sources and clear limits
Official sources cited
5
Editorial responsibility
StopArnaques

StopArnaques is an independent Belgian service. It is not a public authority and does not speak on behalf of the organisations cited.

Report a correction

Check a suspicious link

I already took action

I already took action

I already took action

I already took action

Prepare my next steps