I clicked a phishing link: what to do next
The text looked like a delivery notice, or the email looked like it came from your bank, and you tapped the link before the doubt caught up. Now the page looked slightly wrong, or asked for a password, or just went blank, and your stomach dropped. Almost everyone who uses a phone has done this at least once. The people who build these messages are professionals, and the good ones are hard to tell apart from the real thing at a glance.
The good news is that clicking a link, on its own, usually does much less damage than people fear. What matters is what happened after the click, and that is easy to sort out in a calm, orderly way. Here is how to do it.
First, work out what the click actually did
There are three different situations, and they call for different responses. In the first, you tapped the link, the page opened, and you closed it without typing anything or downloading anything. That is the mildest outcome. In the second, the page asked for something, such as a password, a card number, a code, or your Social Security number, and you entered it. That is the one to act on quickly. In the third, the link downloaded a file or prompted you to install something, and you opened it. That is a device problem as much as an account problem.
If you are not sure which one applies, treat it as the more serious one for the next hour. It costs very little to be careful, and you can relax the steps later.
If you only opened the page
Close the tab, and if you are on a phone, clear the browser history for that visit. Modern phones and browsers are fairly good at containing a plain page view, so there is usually nothing further to do. It is still worth running your phone or computer’s built-in security scan, keeping your operating system up to date, and watching your accounts for anything unusual over the next few days. Do not reply to the message or tap anything else in it, including the “unsubscribe” or “stop” option, since that only tells the sender your number is active.
If you typed something in
Change the password for that account right away, from a different, trusted device if you can, and by going to the real site or app directly rather than using any link. If you reused that password anywhere else, change those too, starting with your email, since your email account can reset almost everything else. Turn on two-factor authentication where you have not already, preferably with an authenticator app instead of text messages.
If you entered a card number, call the number on the back of the card and ask them to freeze or replace it. If you entered a bank login, call the bank using a number from their official website or your card, and tell them what happened. If you gave a Social Security number or other identity details, consider a free fraud alert or credit freeze with the credit bureaus, which stops new accounts from being opened in your name. And if you read a one-time code to anyone, our post on what to do after reading back a verification code covers what that gives a scammer access to.
If something was downloaded or installed
Disconnect the device from Wi-Fi, run a full scan with a reputable security tool, and remove anything you do not recognize. If the page told you to paste a command or install a “fix,” read our piece on the fake CAPTCHA scam that hijacks your computer. If anyone was ever given remote access, or you think someone may be controlling the machine, see what to do if you gave a scammer remote access. In either case, do your password changes from a different, clean device, since a compromised one can capture what you type.
Keep a record, then report it
Before you delete the message, take a screenshot of it and note the sender, the time, and the link, without tapping it again. Forward phishing emails to reportphishing@apwg.org and the impersonated company, and forward texts to 7726 (SPAM), which is free. You can also file a report at ReportFraud.ftc.gov, and at IC3.gov if money or personal data was taken. Reports on their own may not lead to a personal response, and we are honest about that in what to do when you reported a scam and no one responded, but they do feed the patterns that get sites taken down.
Watch, but do not spiral
For the next few weeks, glance at your bank and card statements, and be wary of follow-up calls that mention the incident. Scammers sometimes call back posing as the bank’s “fraud department” to finish what the link started. If anyone contacts you unexpectedly about it, hang up and call the number on your card yourself.
You did the human thing, and you noticed and are dealing with it. That puts you ahead of most people. If you are not sure whether what you entered was enough to worry about, or something feels off and you would like a second pair of eyes, you are welcome to reach out and we will look at it with you, privately.
— Gus