Quick answer
Do not open a doubtful link just to inspect it. Check the real domain, shorteners, redirects, impersonation tricks and the context of the message. If it asks you to log in, pay or enter codes, use the organisation’s official channel first.