The one letter that makes a scam link look real

A phishing link rarely looks wrong at first glance. No strange numbers, no extra words, nothing that trips the usual instinct. According to Guardian News and Media, that is exactly the point. Fraudsters are swapping in letters from other alphabets that look almost identical to the ones people expect, and the eye reads straight past them.

The technique has a name, a homoglyph attack. A homoglyph is a character built to look the same as another one but isn't. Jake Moore, global security adviser at ESET, gives the example of a fake Microsoft site using the Cyrillic "с" in place of the Latin "c", so miсrosoft reads as microsoft unless someone stops to check. Tech experts also found fraudsters using the Japanese hiragana character ん to stand in for a forward slash, in an address built to resemble Booking.com.

Where the scam actually works

The scam does not depend on the fake letter being invisible. It depends on the reader never pausing long enough to look for it. Marijus Briedis, chief technology officer at NordVPN, describes homoglyph attacks as a psychological trick rather than a technical one. The email or text is built to create urgency, something needing to be sorted out right now, so the click happens before the eye has a chance to check.

That is the step the whole scam rests on. Not the character swap itself, which is just typography, but the rushed decision that follows it. Briedis puts it plainly: when people are in a rush, their brains see what they expect to see. A person primed to expect a genuine Microsoft or Booking.com link will read a lookalike letter as the real one, because that is what the brain is scanning for.

Most phishing attacks now point to links rather than attachments, according to Moore, because attachments get scanned and flagged by security software. A link that looks clean sails past that kind of filter. The fraud is built entirely around the click, and the click is built around not thinking.

Where the fake letter hides

Some fonts make this worse. In certain typefaces, a Cyrillic "a" sitting inside an email address does not look out of place at all, because the font renders it almost identically to the Latin one. Years of advice to check the website before trusting it assumed the letters themselves could be trusted to look different when they were wrong. This technique breaks that assumption without breaking the advice; the checking still works, it just has to happen before the click, not after the panic.

The tell is not a strange URL structure or a misspelled brand name. It is the presence of urgency itself. A message that pushes for an immediate click is the signal to slow down and look at the address character by character, ideally by typing the real one in directly rather than following the link at all.