Clicked a Phishing Link? What to Do, Based on What Happened Next

Disclosure: We may earn a commission when you buy through links on this page, at no extra cost to you. How we make money.

What happens if you click a phishing link?

Usually the click is only the start. Phishing pages mostly want you to do something next: type a login, enter card details, install a file or allow notifications. The outcome depends far more on those steps than on the click.

That doesn’t mean a click is risk-free, and it’s where security blogs disagree. Some call it mostly harmless, while others warn that the page can collect details about your device. The official advice is cautious and cheap to follow: the FTC and the UK’s NCSC both say to run a security scan if you opened a link. Do that even if nothing seemed to happen.

Before you close the tab, take a screenshot if you can do it quickly. The address and the message will help your bank or IT team. Then close it, and don’t go back to “check” the page.

If you only opened the page

You typed nothing, downloaded nothing and allowed nothing. Update your security software, run a scan and remove anything it flags. On Windows, Microsoft’s path is Windows Security > Virus & threat protection > Quick scan. If the scan finds nothing and you’re still worried, Microsoft suggests checking the device more thoroughly.

Then report the message (see below) and delete it. If it claimed to be from a company you use, contact that company through a website or number you already know, not through anything in the message. No password change is needed unless you typed one.

If you typed a password

Treat that password as stolen and move quickly. A fake login page looks real, so don’t use the link again. Type the real address yourself or use a bookmark.

1. Change the password on that account, and on every other account that used the same one. The NCSC’s recovery guide calls out reused passwords for this reason.
2. Sign out of all devices from the account’s security settings, so anyone already logged in gets removed. Both the NCSC and the FTC list this as its own step, separate from the password change.
3. Turn on two-step verification. The NCSC also suggests a passkey where the service offers one.
4. Check what an intruder could have changed: recovery email and phone, email forwarding rules and filters, connected apps, and your sent and deleted folders.
5. Warn your contacts if messages went out from your account. Tell them not to click the links or respond to requests for money.

Forwarding rules are easy to forget, and they’re a good reason to keep going after the password change. A rule someone else added can keep copying your mail to them after you’ve changed your password, and that could include password reset emails from other services.

Google, Apple and Facebook accounts

• Google: Google’s guide says to review security events in your account settings, remove unknown devices, check apps with access, and look at Gmail forwarding and filters. Locked out? Use its recovery page.
• Apple: change your Apple Account password and make sure two-factor authentication is on. Apple says it will never ask you to turn off two-factor authentication or Stolen Device Protection, so treat any message asking for that as a scam.
• Facebook: Meta’s help page points to facebook.com/hacked, ideally from a device you’ve logged in with before. Log out unknown devices under “Where you’re logged in.” If your email was changed, Facebook’s message to your old address has a link to reverse it.

If you also typed a one-time code

This part is our reading of how these attacks work, not a line from the guidance above. Two-step verification only helps if the code stays with you. A fake page that asks for a code can pass it to the real site while it’s still valid, so assume someone may already have logged in. Follow the whole list above, and read the account’s recent activity closely.

If you gave card or bank details

Contact your bank or card issuer before anything else, using the number on the back of the card or the bank’s own app. Don’t use a number from the message. Tell them what you entered and ask what they can block. If money has already gone, the FTC’s scam guide says to report it right away and ask for a refund or reversal.

In the US, if you gave your Social Security number, go to IdentityTheft.gov, which the FTC says gives you a personalized recovery plan. A credit freeze is also worth considering. It’s free, doesn’t affect your credit score, lasts until you lift it, and has to be set separately with Equifax, Experian and TransUnion.

In the UK, tell your bank, then report to Report Fraud or call 0300 123 2040. In Scotland, call Police Scotland on 101.

If you downloaded or installed something

The order changes here. If malware is running, anything you type on that device could be exposed, including a new password. The FTC’s malware guidance says to stop logging in to accounts right away, including banking and shopping, then update your security software and scan. Passwords come after that.

1. Don’t open the file if you haven’t already.
2. Stop logging in to anything on that device.
3. Update your security software and run a scan. Remove what it flags and restart.
4. Change important passwords, starting with email and banking. Our suggestion: do this from a different device you trust, especially if the scan found something.
5. Turn on two-step verification on those accounts.

Some security vendors tell you to disconnect from the internet first. The FTC and NCSC pages we read don’t list that step, and your scanner needs a connection to update. Our view: disconnect and get help if you’re seeing active trouble, such as a ransom note. Otherwise, follow the steps above.

Signs that something is still wrong, from the FTC’s list: the computer slows or crashes, your home page changes, new toolbars or add-ons appear, pop-ups multiply, Task Manager is disabled, or posts and emails you didn’t write appear. If you see these after a scan, contact the device maker or a trusted tech support company.

Clicked a phishing link on your phone

The same rules apply to accounts, cards and passwords. These checks are specific to phones.

Android: open the Play Store, tap your profile icon, then Play Protect, and check for harmful apps. If it flags an app, tap the notification and uninstall. If you allowed alerts from the site, Chrome’s steps are More > Settings > Site settings > Notifications.

iPhone: if the page asked you to install a profile, check Settings > General > VPN & Device Management and remove anything you don’t recognize (Apple’s guide to profiles). To clear what the site stored, Apple’s path is Settings > Apps > Safari > Clear History and Website Data. That clears browsing data only, so it won’t undo a password you already typed.

If it happened on a work account or device

Tell IT or your manager straight away, even if it feels embarrassing. The NCSC also says to contact IT for work devices. They may need the original message and can warn colleagues who got the same link, so hold off on deleting it until they’ve answered. If your small team has no written rules yet, our AI acceptable use policy template is one place to start.

Where to report a phishing link

Reporting won’t fix your account, so do it after the urgent steps.

• US: forward emails to reportphishing@apwg.org, forward texts to SPAM (7726), and report at ReportFraud.ftc.gov.
• UK: use the NCSC’s email reporting page and forward texts to 7726.
• Apple-themed scams: forward to reportphishing@apple.com.
• Elsewhere: use your email app’s report option, plus your national cybercrime or police reporting service.

Which steps you can skip

If you only opened the page and the scan is clean, you’re done after reporting it. Nothing in the official guidance we read asks you to replace passwords or devices, or buy a protection product, for that alone. If you typed a password, the account steps aren’t optional. Start with your main email, since it can usually reset your other accounts.

Using AI browsers or agents that click links for you? Our guide to AI browser safety covers those risks.

Sources

• FTC: How to recognize and avoid phishing scams
• FTC: How to recover your hacked email or social media account
• FTC: Malware
• FTC: What to do if you were scammed
• FTC: Credit freezes and fraud alerts
• NCSC: What to do if you’ve shared information
• NCSC: Recovering a hacked account
• Google: Secure a hacked or compromised account
• Apple: Recognize and avoid social engineering schemes
• Meta: Recover your Facebook account if you were hacked
• Microsoft: Stay protected with Windows Security

Pages checked October 31, 2026.

Frequently Asked Questions