Cybersecurity

Clicked a Phishing Link? Do This Now

You clicked a link and now something feels wrong. Take a breath — in most cases the damage is fixable, and the first few minutes matter more than the click itself. This guide walks you through exactly what to do first, what to do second, and what to check over the next few days, depending on what you clicked, entered or downloaded.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

First: stop, close, and assess what happened

Close the tab or window now. If a download started, do not open it. If a pop-up is warning you that your device is infected and offering a fix, do not click it — that warning is part of the scam. A real antivirus alert never arrives inside a web page asking you to call a number or download a cleaner.

Now work out which of three situations you are in, because the next steps depend on it. Situation one: you only clicked the link and nothing else happened — no login, no download, no details entered. Situation two: you entered information — a password, a username, payment details, or a one-time code. Situation three: you downloaded or opened a file, or the page asked you to install something or enable a feature.

Write down what happened while it is fresh: the sender address, what the message claimed, the link you clicked, what you entered, and the time. You will need these details when you report it, and they help your bank or IT team help you faster. Do not worry about blame — phishing is designed to catch busy people, and the fix matters more than the cause.

If you only clicked the link

Good news: clicking a link on its own usually does little damage. Modern browsers are built to contain web pages, and simply visiting a page rarely installs anything by itself. But do not assume you are safe — some pages try to download a file automatically, or use a fake login that you might fill in later. Check your downloads folder for anything unexpected that appeared at the time you clicked.

Clear the browser data for that session if you want to be thorough, and close any other tabs the page opened. If the page asked your browser for permissions — notifications, location, or to download a file — say no, and remove any permission you accidentally granted in your browser settings. On most phones this is in the browser's site settings; on desktop it is under the padlock or site-information icon in the address bar.

Watch the account the message was about for a few days. If it was a bank message, check your transactions. If it was an email account, check for unfamiliar login alerts. No further action is usually needed, but stay alert — and report the message so the malicious site can be taken down.

If you entered a password or username

Act now, starting with the affected account. Go to the real website by typing the address yourself or opening the official app — never through the message link — and change the password immediately. Choose a long, unique password you have not used anywhere else. If you use a password manager, generate a new one there; if not, this is the moment to start using one.

Next, change the same password everywhere else you reused it. This is the step people skip, and it is the step attackers count on: stolen passwords are tried against email, banking, shopping and social media accounts automatically, often within minutes. If you reused it on your email account, that is the most urgent one, because access to your email lets an attacker reset almost everything else.

Turn on two-factor authentication on the affected account and on your email account. An authenticator app or a security key is stronger than a code sent by text, but any second factor is far better than none. Then check the account: recent sign-ins, connected devices and apps, and recovery details. If an unfamiliar device is listed, sign it out. If your recovery email or phone number was changed, restore it and contact the provider's support.

If you entered payment details

Contact your bank or card provider immediately — do not wait to see whether money disappears. Tell them you entered card details on a phishing site. They can watch the account, block the card, and issue a replacement. If money has already been taken, report it as fraud and ask about the dispute process; in many countries your bank can reverse unauthorised transactions, but the sooner you report, the better your chances.

Check your statements carefully for the next few weeks, including small transactions. Criminals sometimes test a stolen card with a tiny charge before a large one, and a small unfamiliar payment is a warning worth acting on. If you entered bank login details rather than card details, ask your bank to reset your online banking access and to review recent payments and any new payees or standing orders.

If you entered details on a shopping or payment service account, change that account's password, turn on two-factor authentication, and check for unfamiliar orders, saved cards, or changed addresses. Keep every reference number your bank gives you, and keep a note of the times you called.

If you downloaded or opened a file

Disconnect from the internet to stop anything the file may have installed from communicating or spreading. Do not open the file again, and do not run anything it asks you to install. On a work computer, tell your IT team immediately — they would far rather hear about it in the first hour than discover it a week later.

Run a full scan with your security software, not a quick scan, and let it finish. If it finds and removes something, change the passwords of your important accounts — email, banking, social media — from a different, clean device, not the affected one. If your security software is not installed or not up to date, use your operating system's built-in protection: Windows Security on Windows, or the built-in protections on a Mac, and consider asking a trusted professional for help rather than downloading a random cleaner from the web.

If the device is a work machine, or if the scan finds something you cannot remove, the safest step is a full reinstall or a professional clean-up. Backups matter here: if you have a recent backup made before the incident, you can restore your files after the device is clean. If you do not back up yet, set it up once this is over — a backup is the difference between a bad afternoon and a lost archive.

If you shared a one-time code

A one-time code is the key to your account, and sharing it is the most urgent situation in this guide. Change the password of the account the code belonged to immediately, from the real site or app, and turn on two-factor authentication using an authenticator app or security key instead of text codes if that option is available.

Check what the attacker may have done while inside the account: look at recent activity, sent messages, changed recovery details, and any new devices or apps connected to it. If the code was for your email account, check for mail forwarding rules you did not set — attackers sometimes add a rule that quietly forwards your mail to themselves. Also check for new filters, blocked contacts, and deleted messages.

Contact the service's support if you cannot get back in, or if you see activity you did not do. Tell your bank as well if the code was related to a payment or banking service. And remember the rule for next time: no genuine member of staff will ever ask you to read out a one-time code, by phone, email or chat. Anyone asking for one is not who they claim to be.

Over the next few days: what to watch

For the next week, watch for three things. First, account alerts: password reset emails you did not request, login notifications from unfamiliar places, or messages saying your details were changed. Second, money: unfamiliar transactions, even small ones, and new payees or direct debits. Third, your contacts: friends or colleagues receiving strange messages from your accounts, which can mean your account is being used to phish them.

If the phished account was your work email, tell your IT or security team even if you have already fixed it yourself. Attackers who get one credential often try colleagues next, and a warning from you can stop the follow-up. If the attack targeted your employer, say so in your report — the details help their security team block the campaign.

Keep notes of everything you did and when: the password changes, the calls to your bank, the reference numbers. If anything was stolen, these notes support a fraud report and any claim. Save the original phishing message too — do not delete it until you have reported it.

How to report it

In the United States, report phishing to the FBI Internet Crime Complaint Center at ic3.gov, giving as much detail as you can. In the United Kingdom, forward phishing emails to [email protected], and forward suspicious texts to 7726. If the phishing pretended to be a specific company, forward it to that company's published abuse or phishing address as well — most large companies publish one, and they use reports to take fake sites down.

Also use your email provider's report-phishing button, and your browser's report option if the link is still live. Every report shortens the life of the malicious site and reduces the number of people it reaches. Reporting is free, takes a minute, and is the single most useful thing you can do after protecting yourself.

If money was stolen, report it to the police as fraud as well as to your bank, and keep the crime reference number. The full reporting guide, with the official routes for the United States and the United Kingdom, is in our how to report phishing guide.

How to avoid the next one

The habit that prevents almost all phishing damage is simple: never log in or pay through a link in an unexpected message. Go to the real app, or type the address yourself. Make your passwords long and unique — a password manager makes this painless — and turn on two-factor authentication on email, banking and social media first, because those accounts unlock everything else.

Slow down when a message creates urgency. A message that says your account closes in an hour, a parcel will be returned, or a payment failed is designed to make you act before you think. Genuine organisations survive a five-minute check; scams do not. If in doubt, contact the organisation through a channel you already trust — a number on their official website, or the app on your phone.

Finally, remember that clicking does not make you careless. Phishing is a professional industry, the messages are getting better every year, and everyone receives them. What matters is not that you clicked — it is what you do in the minutes after. You have now done the hard part: you noticed, and you acted.

Sources

• FBI Internet Crime Complaint Center — IC3 — last checked 14 November 2026.
• National Cyber Security Centre (UK) — Phishing guidance — last checked 14 November 2026.
• Federal Trade Commission — How to recognise phishing — last checked 14 November 2026.
• CISA — Cybersecurity best practices — last checked 14 November 2026.

Last checked: 14 November 2026.

Frequently asked questions

I clicked a phishing link but did nothing else. Am I safe?

In most cases, yes. Simply visiting a page rarely installs anything by itself. Check your downloads for anything unexpected, remove any permissions the page asked for, and watch the account the message was about. If nothing was entered and nothing downloaded, no further action is usually needed.

I entered my password on a phishing site. What first?

Change that password immediately from the real website or app — never through the message link. Then change the same password everywhere else you reused it, turn on two-factor authentication, and check the account for unfamiliar devices or changed recovery details.

Should I call the number on the phishing page?

No. Never call a number shown on a suspicious page or in a suspicious message. If you need to contact the organisation, use a number from its official website or the app you already have installed.

I downloaded a file from a phishing link. What now?

Disconnect from the internet, do not open the file again, and run a full scan with your security software. On a work computer, tell your IT team immediately. Change important passwords from a different, clean device.

How do I report a phishing link I clicked?

In the US, report it to the FBI Internet Crime Complaint Center at ic3.gov. In the UK, forward the email to [email protected] and forward suspicious texts to 7726. Also use your email provider's report-phishing button.

Will my bank refund money lost to phishing?

It depends on your country and your bank's rules. Report it as fraud immediately and ask about the dispute process — the sooner you report, the better your chances. Keep every reference number and a note of when you called.