Short links in SMS campaigns: trust, length and click tracking

Short links in SMS are hard to avoid. A text message has little room, and a full URL with tracking parameters eats most of it. Yet fraudsters rely on the same short links, and banks and governments now tell people to be wary of links in text messages. This guide shows how to put a short link in an SMS campaign that recipients can recognise, that you can measure without following anyone, and that you can close when the campaign is over.

One thing first: EUQR does not send SMS. You send the message through your SMS provider or CRM. EUQR supplies the link on qreu.eu, counts the clicks and lets you change or close the link later.

Why an SMS needs a short link

A single SMS holds 160 characters in the standard GSM 7-bit alphabet. Once a character outside that alphabet appears, the limit drops to 70, according to the SMS format documentation from Mapp. Longer texts are split into parts and joined again on the phone, and most providers bill each part.

A product page URL with UTM parameters easily runs to 120 characters. Put that in a message and there is no room left for the sender's name, the offer and an opt-out line. A short link of about 25 characters leaves space for the words that make a recipient trust the message.

Readability matters as well. On a phone, a long URL wraps over three lines and looks like noise. A short link with a clear word in it reads as part of the sentence.

Why short links in SMS look like smishing

Smishing is phishing by text message. ABN AMRO describes it as a fake message by SMS, WhatsApp or another messaging service in which the link leads to a fake website. Its page on smishing advises customers to "Be very cautious about clicking links". The bank also states that it will never ask customers to log in to its app or internet banking through a link in a text message.

Governments give the same advice. In a press release of 2 February 2024, the Luxembourg government told citizens not to click on unknown or suspicious links. It added that its authorities do not ask for personal data by SMS or e-mail, and that any request should be checked on the official website of the institution concerned.

Carriers and SMS providers respond with filters. Bird, an SMS provider, explains in an article on public link shorteners that a shared short domain inherits the reputation of every sender behind it. A hidden destination from an unfamiliar sender is hard to tell apart from phishing. The risk sits in the combination: an unknown sender, an anonymous domain and a slug of random characters.

How to make short links in SMS trustworthy

Trust in a text message comes from small, consistent signals. None of them is a guarantee, but together they make your message look like what it is.

• Name the sender in the first words. Use the sender name your provider allows, and repeat the brand in the text itself.
• Use a readable slug. A link ending in /autumn-bulbs tells the recipient where it goes. A link ending in /x7Kp2 tells them nothing.
• Send people to a page they know. The destination should be your own website, on the address they would type themselves.
• Announce the channel. Tell customers on your website or at the till that offers arrive by SMS, and under which sender name.
• Drop the urgency. ABN AMRO lists pressure to act "urgently" or "fast" as a warning sign. A campaign that ends on Sunday can say so calmly.
• Never ask for a login or payment details behind the link. That is the pattern fraudsters copy.

Our guide to branded short links covers slug conventions in more detail.

What a qreu.eu link can and cannot do for trust

Here EUQR has to be plain about its own limits. Links from the EUQR link shortener run on qreu.eu, a short-link domain that all EUQR customers share. A domain of your own is only available with the Enterprise white-label plan.

A shared domain carries the reputation of everyone who uses it, as the Bird article explains. So a qreu.eu link is more recognisable than a random public shortener only when your SMS names the sender and the slug is readable. A bare qreu.eu link with random characters, sent from an unknown number, looks as anonymous as any other short link.

What qreu.eu does give you: link and click data hosted in Amsterdam, no tracking cookies on the redirect, a slug you choose, and a destination you can change after the message has gone out. If delivery through a specific carrier is critical, ask your SMS provider how it treats your link domain before a large send, and test with a small batch first. Bird itself notes that owning a domain does not guarantee a good reputation or delivery.

For a wider view of hosting and data handling, see the page on our European URL shortener.

What to count, and what to leave alone

A short link tells you how often it was opened, when, and from which country, device type and language. EUQR shows those as aggregate counts per link, without cookies and without storing raw IP addresses. That is enough to compare campaigns and sends.

The tempting next step is a unique link per recipient, so you can see exactly who clicked. Avoid it. A personal link turns a campaign count into a record of individual behaviour, and that brings the consent rules for tracking into play. Our article on the EDPB guidelines for tracking links explains the framework. This is not legal advice.

A better pattern is one link per campaign, or one per send if you text the same offer twice. Name the slugs so they sort well, for example /bulbs-oct-1 and /bulbs-oct-2. Comparing the two counts shows which day and time worked, without knowing who anyone is.

Example: a garden centre chain texting its loyalty members

Picture a garden centre chain with twelve stores and a loyalty programme. Members have agreed to receive offers by SMS, and in October the chain wants to promote spring bulbs.

The message reads: "GreenLeaf: spring bulbs 3 for 2 in all stores until Sunday. Details: qreu.eu/greenleaf-bulbs. Stop texts: reply STOP". It names the sender twice, the slug matches the offer, and the whole text fits in one 160-character message.

The marketing team sends it in two waves, on Tuesday evening and Saturday morning, each with its own link. Both links point to the bulbs page on the chain's own website, so recipients land on an address they recognise. On Monday the team compares the click counts of the two waves and keeps the better slot for the next campaign.

Nobody in the team knows which member clicked, and they do not need to. The campaign question was which wave worked, and the aggregate answer covers it.

Close the link after the campaign

An SMS stays in an inbox for months. If its link keeps pointing to an offer that has ended, people get a stale page. Worse, an old campaign gives fraudsters a template for a convincing "your offer is still waiting" message.

EUQR lets you set an expiry date, a click limit or a password on any short link, and change the destination whenever you need to. For an SMS campaign, the practical choice is an expiry date a few days after the offer ends. The alternative is a new destination, such as your general offers page instead of the expired promotion. Check what the link shows after expiry before the campaign starts, so you know what a late reader will see.

When not to send a link at all

Some messages are better without any link, short or long:

• Payment requests and reminders. Ask customers to pay in your app or on the website they know.
• Password resets and login prompts, unless the customer has just requested one on your site.
• Changes to bank details or delivery addresses.
• Requests for personal data, the very thing the Luxembourg government says its authorities never ask for by text.

In these cases, tell the recipient what to do and where to go by name: "open the GreenLeaf app" or "log in on our website". That is the advice banks give their own customers, and following it makes your real messages look different from the fake ones. For the related risk of fake QR codes on posters and parcels, read our article on quishing.

Getting started

Branded short links on qreu.eu are included in every paid EUQR plan, from Starter at €0.99 per month with 50 short links to Pro at €9 per month with 250 links and bulk import via CSV. All plans and limits are on the pricing page.