I clicked a phishing link. What now?

Short answer: Stop interacting with the page, change any password you may have typed (from the official site), turn on 2-factor login, call your bank if you entered card details, and run a device scan. Then watch for follow-up scams that pretend to be “fraud support.”

This expands the short checklist already linked from the PhishCheck FAQ. You’re not alone — clicking once is common; what you do in the next half hour matters most.

First: breathe, then stop the bleed

Panic is what scammers want. You do not need to pay anyone who calls claiming they can “unlock” your account if you buy gift cards or crypto.

1. Don’t enter anything else on that page. Close the tab or window.
2. Disconnect from Wi‑Fi or unplug Ethernet if you downloaded a file or installed something. (If you only opened a page and typed a password, changing that password is the priority.)
3. Write down what you remember: which brand was faked, whether you typed a password, code, or card number, whether a file downloaded.

The 30-minute checklist

Minute 0–5 — Close and capture

• Close the suspicious tab.
• Screenshot the URL bar if still visible (for reporting).
• Do not click “enable notifications,” “download secure viewer,” or “call this number.”

Minute 5–15 — Passwords

• On a different device if possible, open the real site by typing the address or using the official app (not a bookmark from the scam email).
• Change the password for the account the message imitated.
• Change it everywhere you reused that password.
• If you use a password manager, update the saved entry and check for other weak/reused passwords.

Minute 15–20 — Turn on 2FA

• Enable two-factor authentication. Prefer an authenticator app or hardware key over SMS when the service offers it.
• Review “recent devices / sessions” and sign out unknown ones.

Minute 20–25 — Money and cards

• If you entered card or bank details, call the number on the back of your card (not a number from the message) and ask to freeze or replace the card.
• Watch statements for small “test” charges.
• If you sent crypto or gift cards, report quickly to the platform and local authorities — recovery odds drop fast.

Minute 25–30 — Device health

• If you downloaded a file or ran an installer: run a full malware scan (Windows Defender / built-in macOS protections + a reputable second opinion if you’re unsure).
• Update your OS and browser.
• Uninstall anything you don’t recognize from today.

What if I only hovered / previewed and didn’t log in?

Still wise to:

• Ignore any follow-up “we noticed a login” messages that arrive by SMS/email with a link.
• Confirm recent account activity inside the official app.
• Optionally paste the original message into PhishCheck AI to see which red flags it would have shown — useful for next time.

Reporting (worth five minutes)

• Email provider: Gmail → Report phishing; Outlook → Report → Phishing.
• APWG: forward scam emails to [email protected].
• United States: reportfraud.ftc.gov.
• SMS (US): forward scam texts to 7726 (SPAM).
• Workplace account: tell IT immediately — they may need to reset tokens or hunt lateral movement.

Watch for the second wave

Scammers often call or text soon after, pretending to be your bank’s fraud team, Apple Support, or “Microsoft Security.” They already know you clicked; they’ll use that knowledge to sound legit. Hang up. Call back using the number on your card or the official site.

How PhishCheck fits (before the next click)

PhishCheck AI is built for the moment before you trust a message: paste email, SMS, or a raw link → get No obvious red flags found / Suspicious / Likely scam, the red flags, and plain-English next steps. This app does not upload pasted messages or use them for training. It’s a second opinion, not a guarantee — if you’re unsure, use official channels only.

Demo note: checks run locally in your browser with simple rules — live AI is not available. Not a safety guarantee.

Not sure about another message sitting in your inbox?

Check it free →