What the actual risk is
Opening a redirect does not run anything on your device. The risk is entirely about where you end up: a convincing fake login page, a download you did not intend, or a site that is simply not what the message implied.
A shortened link makes that easier for whoever is sending it, because the usual defence of reading the address before clicking is unavailable.
This is the same reason short links are useful for legitimate purposes and attractive for illegitimate ones. The mechanism does not know the difference.
The domain in front is the signal
Since you cannot read the destination, the only thing left to read is the shortener. That makes the choice of domain the whole trust decision.
A domain run by a service with published terms, an abuse policy and a route for reporting violations is a different proposition from an anonymous free tool with no accountability.
It also matters to you as a sender. If the domain you use is widely abused, mail filters treat your link with the same suspicion as everyone else's, and you inherit a reputation you did not build.
How to check before you tap
- Long press the link on a phone, or hover on a desktop, to see the short address in full. That confirms the domain even when it does not reveal the destination.
- Use a link expander service, which follows the redirect and shows you the final address without opening it.
- Ask the sender. If a link claims to be from your bank, your bank's own app or website is the safer route regardless.
- Treat urgency as a warning sign. Legitimate messages rarely need you to click within the hour.
None of that is specific to short links. It is ordinary caution, applied at the point where the usual visual check is missing.
What sits behind short.bi
Links on short.bi are served over HTTPS, and the domain is operated by Digily Link rather than left open with no oversight.
There is a violation reporting form for anyone who finds a link being misused, and abusive links are removed. That route exists precisely because a shared domain is only as trustworthy as its worst user, and nobody can promise there will never be one.
From your side of the dashboard, you can always see where each of your own links currently points, and change it.
The short version
A shortened link is a redirect. Redirects are ordinary infrastructure and most of the web depends on them.
The care belongs on the domain in front and on the message around it, not on the shape of the link. Judge the sender and the shortener, and where either is unfamiliar, expand before you open.