How to Check Whether a Google Forms or Microsoft Forms Link Is Safe

Online forms are convenient for surveys, registrations, support requests, and internal business workflows. Because people recognize Google Forms and Microsoft Forms as trusted services, attackers also use them for phishing. The form itself may be hosted on a legitimate platform, while the questions, branding, and sender are deceptive.

If you receive a form asking for your email, one-time password, login details, payment information, or identity documents, pause before interacting with it. A safe check is not about whether the platform is real; it is about whether the specific form and the person behind it are trustworthy.

Why form links can still be risky

A Google Forms or Microsoft Forms URL may lead to a real page hosted by Google or Microsoft. That does not automatically mean the request is legitimate.

Scammers use form builders because they are easy to set up, free or low-cost, and familiar to targets. Instead of building a fake website from scratch, they can create a convincing form that asks for:

• Email addresses
• OTP or verification codes
• Corporate login details
• Bank or card information
• Government ID numbers
• Delivery fees or account recovery information

In many cases, the goal is account takeover or identity fraud. If a form asks for an OTP, password, or recovery code, that is an immediate red flag. Legitimate organizations rarely need that information through a form, and many explicitly prohibit collecting it this way.

Start with the context, not just the link

Before analyzing the URL, ask why you received the form in the first place.

Consider these questions:

• Were you expecting this form?
• Does it match an ongoing conversation, job application, support ticket, school request, or business process?
• Did it arrive from a verified contact channel?
• Is there urgency, pressure, or a threat if you do not respond immediately?

A form sent out of nowhere is higher risk than one shared through a known process. For example, a survey link from your manager in your company chat is different from a random message claiming your mailbox will be deleted unless you “confirm” your account details.

If the message feels unexpected, verify the request through a separate channel. Contact the organization using its official website, app, or known phone number, not the contact details inside the suspicious message.

Inspect the URL carefully

A genuine Google Forms link will normally use a Google-owned domain such as docs.google.com or forms.gle. A genuine Microsoft Forms link often uses forms.office.com or another Microsoft-owned domain.

But domain familiarity is only the first step. Check for:

• Misspellings or lookalike domains
• Extra words before or after the real brand name
• URL shorteners that hide the destination
• Tracking-heavy links from unknown senders

If possible, preview the full destination before clicking. On desktop, you can often hover over the link to inspect it. On mobile, long-pressing may reveal the full URL.

If you want a second opinion on the destination, run it through a tool like the LinkExpln scanner. This can help you identify suspicious patterns before you interact with the page. If you want to understand what signals are typically reviewed, see how LinkExpln works.

Look for social engineering on the form itself

Even when the domain is legitimate, the form content may still be fraudulent. Once opened, review the form as critically as you would an email.

Warning signs include:

• Requests for passwords, OTPs, backup codes, or MFA approvals
• Poor grammar, awkward phrasing, or mismatched branding
• Claims that your account will be suspended unless you respond now
• A sender name that does not match the organization being impersonated
• Questions unrelated to the stated purpose of the form
• Payment requests for prizes, refunds, or account verification

For example, a recruiter might reasonably ask for your name, phone number, or portfolio link. That same “recruiter” should not be asking for your email password or a verification code sent to your phone.

Check who created and shared the form

Many people focus on the platform and ignore the sender. That is a mistake.

Look at:

• The email address or account that shared the form
• Whether the organization normally uses forms for this process
• Whether the sender can be verified on an official site or directory
• Whether the form is branded consistently with the real organization

Be cautious with display names. A message can say “Microsoft Support” or “HR Team” while coming from an unrelated account.

If the form claims to come from your bank, employer, school, or a cloud provider, go directly to that organization’s official site and log in there instead of using the form link. If the request is real, you should usually be able to find a matching notice in your account or confirm it through support.

Never enter OTPs or passwords into forms

This is the simplest rule and one of the most effective.

A one-time password, recovery code, or multi-factor authentication prompt is meant to confirm your login action, not to be shared with someone else. If a form asks for an OTP, assume it may be part of an account takeover attempt.

The same applies to:

• Passwords
• Backup codes
• Authenticator app codes
• Security questions and answers
• Full payment card details unless you are on a clearly verified checkout page

Legitimate teams may ask for contact details, case numbers, or screenshots in some support workflows. They should not need your secret authentication information.

Use a few practical safety checks before responding

You do not need a complex forensic process. A short checklist catches many scams.

1. Pause and assess the reason for the form. If it is unexpected, verify independently.
2. Inspect the URL. Confirm the domain and watch for lookalikes.
3. Scan the link first. Use a trusted checker before opening or submitting.
4. Review the questions. Reject any form asking for OTPs, passwords, or unrelated personal data.
5. Check the sender separately. Use official contact information, not details inside the message.
6. Do not let urgency rush you. Pressure is a common phishing tactic.

These habits fit well with broader security practices such as enabling MFA, using a password manager, and keeping devices updated.

What to do if you already submitted information

If you already entered sensitive details into a suspicious form, act quickly.

• Change the affected password immediately
• Revoke active sessions if your account supports it
• Reset MFA if you shared backup codes or authentication details
• Contact your email provider, employer, bank, or relevant service
• Monitor for follow-up phishing messages or unauthorized logins
• Report the form to the platform and your security team if relevant

If you still have the link, you can also report a suspicious link so it can be reviewed and documented.

The bottom line

A Google Forms or Microsoft Forms link can be legitimate, malicious, or somewhere in between: a real form used for deceptive purposes. The safest approach is to judge both the platform and the context.

Treat any form that asks for an email address with caution, and treat any form asking for OTPs, passwords, or sensitive identity data as high risk unless you have independently verified the request through an official channel. A quick URL check, a careful read of the questions, and a separate verification step can prevent many common form-based phishing attacks.

FAQ

Is a Google Forms or Microsoft Forms link automatically safe because it uses Google or Microsoft?

No. The hosting platform may be legitimate, but the person who created the form may still be trying to collect information deceptively.

Why would a scammer ask for an OTP in a form?

Often to complete a login or account recovery attempt that they already started using your email or phone number. Sharing the code can help them take over the account.

Is it safe to give my email address in a form?

Sometimes, yes, if the form is expected and from a verified source. But if the request is unexpected or the form asks for more sensitive information, verify it first.

What should I do if the form came from my workplace or school?

Confirm through an official internal channel such as your company chat, help desk, staff directory, or school portal before submitting anything sensitive.