Clicked a phishing link? What to do next

First, close the page and stop replying to the sender. Then think back to what actually happened. Opening a page, typing a password, approving a login, and running a downloaded file are different incidents.

If this happened on a work or school device, tell the IT or security team now. They may have their own response process, and early notice gives them a better chance of seeing what happened.

Do not go back for another look. Check the browser’s download list to see whether the page saved a file. If it did, leave the file unopened.

Opening a link does not automatically mean that your account was stolen. At the same time, nobody can promise that a page was harmless without examining the device and the site. Make sure the browser and operating system are up to date. If there was an unexpected download or the device is behaving strangely, update your trusted security software and run a scan. The FTC has more detailed malware advice.

You entered a password or approved a sign-in

Go to the real service using its app, a bookmark, or an address you know. Do not use another link from the same message.

Change the password on the affected account. If you reused that password anywhere else, those accounts need new, different passwords too.

Next, sign out of other sessions where the service gives you that option and remove devices you do not recognise. Check that the recovery email address and phone number have not changed, and look for unfamiliar connected apps. Turn on multifactor authentication, or review its settings if it was already enabled.

A password is not the only way to approve access. Tell the service if you scanned a QR code, shared a one-time code, accepted a push notification, or authorised an app. That detail can change what needs to be revoked.

Google users can follow the company’s compromised account checklist. It includes checks for recent security events, unfamiliar devices, and Gmail forwarding rules. Other services have similar recovery pages.

If you are locked out, start with the service’s official account recovery route. Ignore people who appear in your replies or DMs offering to recover the account for money.

You downloaded or ran something

A file sitting unopened in the downloads folder is different from a program you ran. Do not open it to find out what it does.

If you installed software, added a browser extension, or pasted a command because the page told you to, stop using that device for sensitive accounts until it has been checked. Contact your IT team if it is a managed device. On a personal device, use security support you already trust rather than a phone number or tool advertised by the suspicious page.

Write down the filename and where it came from. Do not send the file to friends or post it in a public chat.

You shared card, bank, or identity details

Contact the bank, card issuer, payment service, or relevant organisation through its official app or verified number. Explain exactly what information you shared and follow its fraud process. There is no benefit in waiting to see whether the phishing site is taken down.

If a wallet recovery phrase or private key was exposed, use the wallet provider’s official documentation for compromise guidance. No real support worker needs the phrase itself.

Keep the original message and copy the suspicious URL without reopening it. Note when it arrived and what you entered or approved, but never include the password or recovery phrase in a report.

You can send the website to Phish Takedown and report the original message in the app where it arrived. If your account sent scam messages to other people, warn them through a separate channel that you trust.