- Guide type
- Incident response
- Risk
- High
- Time
- 30–60 min
- Cost
- Free
- Works on
- Phone & computer
- Last verified
- 2026-10-04
The short answer
- You only opened the link and typed nothing? Close it. The risk is low: update your browser and keep an eye out for follow-up messages.
- You typed a password? Change it now from a different device, sign out every other session and turn on two-step verification. Start with your email account.
- You gave card or bank details? Call your bank using the number printed on your card, not a number from the message.
- You downloaded or installed something? Disconnect from the internet first, then follow the full steps below.
Almost everyone clicks a bad link eventually. Phishing messages are built to look like your bank, a delivery company or your own boss, and they arrive when you are busy. What matters now is not the click. It is what you did after the click, and how quickly you close the doors that were opened.
Work through this guide in order. Use the Mark as done buttons as you go: your progress is saved on this device.
First, work out what actually happened
The right response depends on what you did on the fake page. Find your row, then continue with the steps.
| What you did | Risk | Do this first |
|---|---|---|
| Opened the link, entered nothing | Low | Close the tab. Update your browser and operating system. Skip to what to watch for. |
| Entered a password | High | Change that password from another device, then steps 2 to 4. |
| Entered a one-time code (SMS or app) | High | Assume the attacker logged in. Change the password and sign out all sessions immediately. |
| Entered card or bank details | High | Call your bank (step 5). |
| Entered a Social Security number or ID details | High | Freeze your credit (step 8). |
| Downloaded a file, installed an app or a "profile" | High | Disconnect from the internet (step 1), then scan (step 6). |
| Let someone control your screen remotely | High | Disconnect, remove the remote-access app, and treat every password used on that device as exposed. |
The next hour, step by step
-
Stop typing and disconnect if you installed anything
Close the page. If you downloaded a file, installed an app or gave someone remote access, turn on airplane mode or switch off Wi-Fi on that device. Do not sign in to anything else on it until you have finished step 6.
-
Change the exposed password from a clean device
Use a different phone or computer that you trust. Start with your email account, because whoever controls your email can reset almost everything else. Then change the password on the account you typed it into, and on any other account where you reused it. If someone has already changed your Gmail password or recovery details, follow our steps to recover a hacked Gmail account.
Make each new password unique. A password manager makes this realistic; the free tier of a reputable one is enough. To see whether any of your other passwords already appear in known data breaches, try our free, private password leak checker.
-
Sign out other sessions and check your recovery settings
Attackers often stay quiet and keep access. On Google, open the Security Checkup and remove devices you do not recognize. On Microsoft, use account.microsoft.com/security. In both cases check:
- the recovery phone number and recovery email,
- email forwarding rules and filters (a hidden rule that forwards or deletes your mail is a classic sign of takeover),
- apps and third-party services with access to your account.
-
Turn on two-step verification
If it was not on, switch it on now. A passkey or an authenticator app is stronger than a text-message code, but any second step is far better than none. Our passkey setup guide covers Google and Microsoft accounts. If you start receiving login prompts you did not trigger, deny them and change your password again: it means someone still has it.
-
Call your bank or card issuer
If you entered payment details, call the number printed on the back of your card or on the bank's official website. Ask them to block or replace the card and to flag your account for unusual activity. Never use a phone number from the suspicious message.
-
Check the device for anything that was installed
- Windows: run a full scan in Windows Security, then a Microsoft Defender Offline scan. Uninstall programs you do not recognize, especially remote-access tools.
- Mac: check System Settings for unknown login items and profiles, and remove apps you did not install.
- iPhone: go to Settings › General › VPN & Device Management and remove any profile you do not recognize.
- Android: run a Google Play Protect scan, and check the list of device admin apps (usually under Settings › Security; the exact menu varies by manufacturer).
If remote-access software was used, or you are unsure, back up your photos and documents and reset the device to factory settings.
-
Report it
Reporting helps get fake sites taken down and creates a record if you lost money.
- US: report at ReportFraud.ftc.gov. Forward scam texts to 7726 (SPAM). If you lost money, also file a report with the FBI at IC3.gov.
- UK: forward suspicious emails to report@phishing.gov.uk and texts to 7726 (NCSC guidance).
- Use your email provider's Report phishing button so similar messages are filtered for others.
-
If you shared identity details, freeze your credit
In the US, a credit freeze is free and stops new accounts being opened in your name. Place it with all three bureaus: Equifax, Experian and TransUnion. The FTC explains how freezes and fraud alerts work, and IdentityTheft.gov builds a personal recovery plan.
Don't
- Don't reply to the message or call any number in it, even to complain.
- Don't pay anyone who contacts you offering to "recover" lost money. The FTC warns that recovery scams target people who were just scammed.
- Don't approve a login prompt or share a code you did not request.
- Don't delete the message yet if you lost money. Take screenshots first: your bank and the police may need them.
What to watch for over the next 30 days
- Password-reset or "new sign-in" emails you did not request.
- Small test charges on your card, often under a dollar.
- Friends asking about strange messages "from you".
- Login approval prompts you did not trigger.
- Follow-up calls or texts that mention the first message. Scammers reuse lists of people who clicked.
If any of these happen, repeat steps 2 to 4 for the affected account.
How to spot the next one
Most phishing relies on the same three tricks: urgency ("your account will be closed today"), a familiar brand, and a link to a look-alike website. Two habits defeat most of it:
- Go there yourself. Instead of tapping the link, open the app or type the website address you already know.
- Let your password manager be the alarm. It only autofills on the real website. If it offers nothing on a login page that "should" be your bank, stop: the address is probably fake.
If the link came by text message, such as an "unpaid toll" or missed-delivery notice, our guide to fake toll and delivery texts shows how to report it and filter the next ones.
For more examples, the FTC keeps a clear guide to recognizing phishing and scam text messages.
How we checked this
Written by Ariel, ICT engineer. On 2026-10-04 we compared every step against current guidance from the US Federal Trade Commission, the FBI's Internet Crime Complaint Center, CISA and the UK's National Cyber Security Centre, and against Google's and Microsoft's account-security pages. Menu names on Android vary by manufacturer and were not checked on every brand. No products were tested for this guide and it contains no affiliate links.