Clicked on a phishing link? What to do next

If the page loaded and you closed it without typing or downloading anything, the risk is low. Phones and computers with current updates do not get malware just from opening a page.

1. Close the tab or app.
2. Install pending updates for your browser and operating system. Old versions are what the rare drive-by attacks target.
3. Delete the message and block the sender. Clicking tells the scammer your number or address is active, so expect more.

Assume the password is stolen. Scammers often try it within minutes, so do this first.

1. Change the password on the real site, from a device you trust. Type the address yourself or use the app.
2. Change it on every other site where you used the same or a similar password. Start with email: whoever controls your email can reset everything else.
3. Sign out all other sessions. Most services have this under security settings.
4. Turn on two-factor sign-in with an authenticator app or passkey.
5. Check the account for changes you did not make: a new recovery email or phone number, forwarding rules in your inbox, new devices.

If the scammer already changed your password, use the service’s account recovery form now. The sooner you start, the more likely you get the account back.

1. Call your bank on the number on the back of your card, not one from the message. Ask them to block the card and send a new one.
2. Ask about payments from the last few days. Card payments you did not make can usually be disputed.
3. If you gave a code from a text message, tell the bank. Scammers use these codes to add your card to their own phone.
4. If you gave your Social Security number or ID details, freeze your credit and follow the plan at IdentityTheft.gov (US).

1. Do not open the file. Delete it, and empty the trash or downloads folder.
2. If you opened it or installed an app, disconnect from the internet and run a full scan with your antivirus. On Windows, Microsoft Defender is built in.
3. Remove apps you do not recognize. On Android, also check which apps have accessibility or device admin access.
4. From another device, change the passwords for your email and bank.
5. If the scan finds something it cannot remove, or someone asked you to install remote access software, get help from a repair shop you trust, and tell your bank.

Text message phishing (smishing) usually pretends to be a parcel service, a toll or parking fine, or your bank. The same steps apply. Also:

• Do not reply, not even STOP. A reply confirms your number.
• Forward the text to 7726 (SPAM) to report it to your carrier. This works in the US and the UK.
• Delete it and block the number.

Reports help get the site taken down before it fools others.

• US: report the scam at ReportFraud.ftc.gov and forward phishing emails to reportphishing@apwg.org.
• UK: forward phishing emails to report@phishing.gov.uk.
• Everywhere: use the “Report phishing” or “Report junk” button in your email app, and tell the company that was impersonated.

• Check your bank and card statements every few days.
• Expect follow-up messages. Scammers often contact victims again as “fraud support” or a “recovery service” that wants a fee. Your bank will never ask you to move money to keep it safe.
• Before you open the next link you are not sure about, paste it in our free link checker.