Clicked a phishing link? What to do next

Close the tab and don’t reopen the link to see what it was. The FTC’s phishing guidance says that if you think you clicked a link or opened an attachment that downloaded harmful software, update your computer’s security software, run a scan, and remove anything it identifies as a problem.

If the message was about a package and your card might be involved, the U.S. Postal Inspection Service asks people who interacted with a scam link, even without pressing submit, to notify their financial institution.

Then report the message (see how to report it) and delete it. If you entered or autofilled anything, use the matching section below too.

The FTC says that if scammers get your passwords or account numbers, they could get into your email, bank, or other accounts, or sell your information to other scammers.

If you can still sign in, the FTC’s recovery steps are to create a new, strong password for that account, change it anywhere else you used the same password, and turn on two-factor authentication. Open the site or app yourself; don’t use the link from the message.

If you can’t sign in, use the FTC’s hacked-account guide, which links to recovery pages for popular services. A shared one-time code may have approved a sign-in or payment, so contact the affected service, and your bank if money is involved. Our lost-account steps cover what to check after you get back in.

Call the bank or card issuer now. For a credit card, the FTC says to report it to the issuer immediately, using the number on the back of the card or the issuer’s app, and ask them to refund your money. For a debit card, report it to your bank or credit union the same way.

Ask whether the card should be replaced even if no charge has appeared yet. CISA also advises watching for any unexplained charges. Keep the message and any receipts. If you paid another way, see payment-specific steps.

If you think a scammer has your Social Security, credit card, or bank account number, the FTC points you to IdentityTheft.gov, which gives steps based on the information exposed. To decide between a free credit freeze and a fraud alert, see credit freeze vs fraud alert. For a fuller identity checklist, use our identity-recovery guide.

The FTC’s malware guidance says to:

1. Stop signing in to online accounts, such as shopping or banking, with your usernames, passwords, or other sensitive information.
2. Update your security software so it has the latest protections.
3. Run a security scan to remove the malware.
4. Change your passwords and turn on two-factor authentication, in case the malware gave someone access to your accounts.

If someone is controlling the device remotely or you approved access to an account, follow the access section of our recovery guide.

Reporting won’t reverse a charge. Forwarding a text to 7726 helps your wireless provider spot and block similar messages. The FTC lists three routes:

• Text: forward it to 7726 (SPAM), or use your phone’s report-junk option.
• Email: forward it to reportphishing@apwg.org.
• Either: report it at ReportFraud.ftc.gov.

If you lost money, the CISA guidance also suggests a police report.

The FTC says phishing messages try to steal your passwords, account numbers, or Social Security numbers. With that information, scammers could get into your email, bank, or other accounts, or sell it to other scammers. Some links aim to install harmful software: the FTC also says scammers send phishing emails that trick you into clicking a link or opening an attachment that downloads malware.

A click alone doesn’t tell you what was exposed. That’s why the steps above depend on what you did next. If you still have the message, paste it into the checker to see which known pattern it matches.