Clicked a phishing link? Learn what to do immediately, whether you entered information or downloaded a file, and how to protect your accounts, devices, money, and personal information.
You clicked a link you should not have. Maybe it was in an email that looked like it came from your bank, a text about a delivery, or a message from a colleague whose account turned out to be compromised. The first thing to know is this: clicking a link does not automatically mean your device or your accounts have been compromised.
What happens next depends almost entirely on what you did after the click. Simply opening a webpage is very different from entering your password, downloading a file, installing an app, or approving a login. This guide walks through the immediate steps to take in each of those situations, how to assess your risk, and how to limit the damage if something did go wrong.
If you want to understand how these attacks work before reading the recovery steps, see our overview of what phishing is and how phishing scams work. This article stays focused on incident response: what to do after the click has already happened.
Regardless of what kind of link it was, the first few minutes matter. Work through these steps in order.
1. Close the suspicious webpage and stop interacting with it. Close the tab or browser window. Do not keep clicking around to "see what it does." Every interaction is a chance to hand over more information or trigger another action.
2. Do not enter information, download files, allow notifications, or approve unexpected prompts. If the page is asking you to sign in, confirm card details, allow notifications, install something, or approve a login, stop. Legitimate organisations do not need you to do any of these things through a link you arrived at from an unexpected message.
3. If a file downloaded, do not open it. Some malicious pages push a download automatically. If something appeared in your downloads folder, leave it alone for now. Opening it is the step that turns a downloaded file into an active infection.
4. If anything was installed or the device behaves strangely, disconnect and get help. If you suspect software was installed, your device is unusually slow, pop-ups appear, or settings have changed without your input, disconnect the device from the internet (turn off Wi-Fi or unplug the cable) to stop any further communication. Then seek trusted technical assistance, or contact your IT or security team if it is a work or school device.
5. Identify what information, if any, you submitted. This is the most important diagnostic step. Did you enter a password? Card details? A one-time code? Did you approve a login or payment? Did you install an app or allow notifications? Your answer determines which of the recovery sections below applies to you.
The FTC advises that if you clicked a link or opened an attachment that may have downloaded harmful software, you should update your security software and run a scan. We cover that in detail below.
If you opened the link, realised something was wrong, and closed it without typing anything, downloading anything, or approving anything, your situation is relatively low risk. There is an important difference between visiting a webpage and submitting sensitive data to it. A webpage can only do so much without your cooperation.
That said, it is not possible to guarantee zero risk from a click alone. Browser exploits do exist, particularly against outdated software, and some malicious pages attempt drive-by downloads or abuse notification permissions. So take a few sensible precautions:
Do not assume that every click installs malware. Modern browsers and mobile operating systems are sandboxed, and a click by itself rarely results in a compromise. The risk rises sharply when you interact with the page, enter information, or run a file.
This is the scenario to take most seriously. If you typed your password into a fake login page, assume that password is now in the hands of the attacker and act quickly.
Change the compromised password immediately, using the genuine service's official website or app. Type the address yourself or use a bookmark you trust, never a link from the message that led you to the fake page. Microsoft's guidance is explicit: change passwords on all affected accounts, and anywhere else you might use the same password.
Change it everywhere you reused it. Password reuse is one of the most common reasons a single phishing login leads to multiple account takeovers. If you used the same password for your email, social media, shopping, or banking, change it on each of those services and use a unique password for every account.
Enable multifactor authentication. Turn on two-factor authentication (2FA) or multifactor authentication (MFA) wherever it is offered. The FTC recommends turning on two-factor authentication on a compromised account immediately. An authenticator app or a hardware key is stronger than a code sent by text.
Review recent activity and recovery details. Once you are back in the account, check:
If you can no longer access the account, use the service's official account-recovery process. Most providers have a "forgot password" or account-recovery flow that can verify your identity another way. Act quickly, because an attacker who changes the recovery details first can make this harder.
If the compromised account is your email, treat it as especially urgent. Email accounts are the keys to every other service that sends password-reset links to them.
If you entered a card number, banking login, or other financial details on a fake website, contact your bank or card issuer immediately. Speed matters more than anything else here.
Use the official channel. Contact the bank through its official app, its website, or the phone number printed on the back of your card or on a trusted statement. Do not call a number supplied only in the suspicious message.
Explain what happened and ask for the right protection. Depending on the situation, ask whether the card should be blocked and replaced, whether the account needs monitoring, and what dispute or fraud procedures apply. Most banks can freeze or replace a card within minutes.
Review recent transactions. Go through your recent activity and report any unauthorised charges promptly. The sooner you flag them, the better your position under most consumer-protection rules.
If you sent a payment (a transfer, a payment-app transaction, or a card payment you authorised), contact your bank or payment provider as soon as possible and ask whether it can be stopped or reversed. Be honest with yourself about this: recovery is not always possible, and the faster you act, the better the chance. Wire transfers, cryptocurrency, and gift-card payments are particularly hard to reverse.
If the information you shared could be used for identity theft (such as a full name, date of birth, address, and account numbers together), the FTC directs people to IdentityTheft.gov for a personalised recovery plan based on what was lost. Never assume money can always be recovered, but do not let that stop you from reporting quickly.
There is a meaningful difference between a file sitting in your downloads folder and a file you have opened or run. Downloading is not the same as executing.
If a file downloaded but you did not open it: Delete it without running it. Empty the trash or recycle bin. This alone usually resolves the risk.
If you opened or ran the file, or installed an app: Treat the device as potentially compromised.
If a work or school device is involved, contact your IT or security team promptly and follow their instructions. Do not try to clean a managed device yourself, and do not keep using it for sensitive tasks until they have cleared it.
Avoid random "cleaner" apps, unverified removal tools, or pop-ups claiming your device is infected and offering to fix it for a fee. Those are often scams themselves. Stick to well-known, independently reviewed security software.
Phones are not magically safer than computers, but they are also not automatically infected just because a link opened. The steps vary by device and operating-system version, so treat the following as a starting point and check your device's current settings.
For both Android and iPhone:
If you entered credentials or payment information on your phone, the device does not change the recovery steps. Follow the password-change and banking sections above regardless of whether you are on Android or iPhone. Apple advises that if you entered your password or other personal information on a scam website, you should change your Apple Account password immediately and ensure two-factor authentication is enabled.
If you clicked a phishing link on iPhone, an iPhone is not automatically infected merely because a link opened in Safari. iOS sandboxing limits what a webpage can do. The greater risks are entering your Apple ID password, approving a login prompt, installing a configuration profile, or allowing notifications. Address those specifically.
If you clicked a phishing link on Android, the same principle applies. The main risks to check for are an unexpected app install (especially via "Unknown sources" or sideloaded APKs), granted accessibility permissions, and notification spam. Revoke anything suspicious and run a scan with reputable mobile security software if you are concerned.
These three actions are easy to underestimate, and each can cause real harm.
If you allowed website notifications: Malicious sites abuse notification permissions to push fake "virus detected" alerts, phishing pop-ups, or scam ads. Revoke the permission in your browser settings. In Chrome, go to Site Settings > Notifications; in Safari, Preferences > Websites > Notifications; in Edge, Settings > Site permissions > Notifications. Remove any site you do not recognise.
If you shared a one-time code or recovery code: A one-time passcode is not a verification of who you are, it is the second half of a login. Sharing it with someone who already has your password lets them complete authentication. This is the mechanism behind many real-time account-takeover attacks. If you shared a code, secure the affected account immediately: change the password, sign out of all active sessions, and review recent activity. Never share a multifactor authentication code with anyone, no matter who they claim to be. Real support teams and banks will never ask for it.
If you approved a login or "trust this device" prompt: Approving a login prompt can grant an attacker an authenticated session. Go to the account's security settings, review active sessions and trusted devices, and revoke anything you do not recognise. Change the password and re-enable MFA if it was disabled.
After any phishing incident, watch for warning signs over the following days and weeks:
A single warning sign is not definitive proof of malware or account compromise. Some of these have innocent explanations. But several appearing together after a phishing incident warrant a password change, a security scan, and a review of active sessions. If you see unauthorised transactions, contact your bank immediately.
Reporting helps protect other people and, in some cases, supports your own dispute or recovery process.
Reporting does not guarantee an individual resolution, but it contributes to the data used to shut down scams and warn others.
The safest way to handle a suspicious link is to avoid opening it until you have assessed it. A few habits make a real difference:
To assess a URL before you visit it, you can use Scamlify's AI URL Scam Checker. It analyses the domain, structure, and impersonation signals and explains the evidence in plain language. Automated analysis is not a guarantee of safety: it cannot establish that every URL is harmless, and it does not replace official security software or the account-recovery steps described above. Treat it as one source of evidence alongside your own judgement.
If the suspicious link arrived by email or text, you can also use Scamlify's AI Email Scam Checker or SMS Scam Checker to assess the message itself, and the Email Header Analyzer to inspect authentication results when you have the raw headers. For a broader prevention checklist, see our guide on how to tell if a link is safe before clicking.
Use this quick checklist after the incident. The steps you need depend on what happened.
If you only opened the link:
If you entered a password:
If you supplied payment or banking details:
If you downloaded and opened a file or installed an app:
Close the suspicious webpage immediately and stop interacting with it. Do not enter any information, download files, allow notifications, or approve unexpected prompts. Then work out what, if anything, you submitted. If you entered a password, change it on the genuine service and enable multifactor authentication. If you entered payment details, contact your bank or card issuer straight away.
Clicking a link alone does not automatically infect or hack a phone. Modern mobile operating systems limit what a webpage can do without your permission. The real risk comes from what happens after the click, such as entering credentials, installing an app, approving a login, or allowing notifications. If you only opened the page and did nothing else, the risk is generally lower, though not zero.
Close the page and avoid downloading files, installing apps, or granting permissions. Check your browser downloads and notification settings, and run a reputable security scan if your device shows unusual behavior. The risk is usually lower when nothing was entered or downloaded, but no single click can be guaranteed to be completely risk-free.
If you only clicked the link and did not enter your password, you usually do not need to change it. If you entered your password on a fake website, change it immediately on the genuine service, change it anywhere else you reused it, and enable multifactor authentication. Also review recent login activity and active sessions.
Contact your bank or card issuer immediately through its official app, website, or the number on your card. Ask for the card to be blocked or replaced, explain what happened, and request transaction monitoring. Review recent transactions and report any unauthorized activity promptly. If you sent a payment, ask whether it can be stopped or reversed, but recovery is not guaranteed.
Yes, it is possible, but a click alone does not guarantee infection. Malware is more commonly delivered through downloaded files, installed apps, or browser exploits targeting outdated software. Keeping your browser and operating system updated and running reputable security software reduces the risk. If a file downloaded automatically, do not open it.
Look for unfamiliar logins, unexpected password-reset messages, unauthorized transactions, apps you did not install, browser changes, or messages sent without your knowledge. Individual signs are not definitive proof of compromise, but several together warrant a password change, a security scan, and a review of active sessions.
No. A URL checker can identify known threats and suspicious characteristics, but no automated tool can guarantee that every link is safe. Use it as one source of evidence alongside independent verification, and never treat an automated result as a substitute for security software or account-recovery steps.
Know in seconds if it’s a scam.
Paste an email, text or link. Scamlify’s AI returns a risk score, the exact red flags and what to do next — while teaching you the pattern behind the attack. No account, no storage, nothing logged.
Scamlify — AI-Powered Scam & Security Intelligence Platform. Sitemap.