Clicked a Phishing Link? What to Do Right Now
Clicking a phishing link is a mistake almost everyone can make — the pages are designed to look real. What matters is what you do in the next few minutes. Work through these steps in order, starting with stopping anything the page may have started.
Follow these steps
- Close the page and disconnect if you are worried. Close the tab straight away. If you entered details, or if a download started, disconnect from the internet as well. That stops the page communicating further while you sort things out.
- Do not enter anything else. If the page asks for a password, a code, or payment details, do not provide them. If you already entered a password, treat that password as compromised and move to the next step.
- Change the affected passwords from a clean device. Using a device you trust, change the password for any account whose details you entered — starting with your email. Use a new, unique password for each account, not a variation of the old one.
- Turn on two-factor authentication. If it is not already on, turn on two-factor authentication for the affected accounts. Even if someone has your old password, a second factor blocks them from signing in.
- Contact your bank if money or payment details were involved. If you entered card or bank details, or made a payment, contact your bank or card provider straight away. They can watch for fraud, block a card, or reverse a payment far more easily if you tell them early.
- Scan your device and check for changes. Run a security scan with your device's built-in tools. Also check your email settings for forwarding rules or filters you did not create, and check recent logins on your important accounts.
What NOT to do
- Do not ignore it and hope for the best — a few minutes of action now prevents most of the damage.
- Do not reuse the compromised password anywhere else, even with a small change.
- Do not call a number shown on the phishing page for help. Use the official support channel of the real company.
- Do not delete the evidence before you have noted what you clicked and what you entered — your bank may ask.
Once the passwords are changed, two-factor authentication is on, and your device is scanned, you have covered the important ground. Stay alert for follow-up scam messages for a while, and treat any unexpected contact about the incident with suspicion.