Clicked a phishing link? Do these things, in this order
Clicking the link is rarely the disaster — what matters is what happened next. If you only clicked and closed it, the risk is low. If you typed a password, downloaded a file, or installed anything, work through the steps below now. They're in priority order, and most of the damage from phishing comes from the hours of delay, not the click.
The steps
- If you downloaded or opened a file: disconnect from the internet (Wi-Fi off / cable out) and run a full antivirus scan before reconnecting. Don't open the file a second time 'to check'.
- Change the password for the account that was imitated — starting from the official app or the address typed by hand, never from the message's link. Turn on two-factor authentication while you're there.
- Change that password anywhere else you reused it. Phished passwords get tried against email, banking, and shopping accounts automatically. Email is the master key — do it first if it shared the password.
- Check the real account for damage: recent sign-ins, sent mail you didn't write, new recovery emails/phone numbers, forwarding rules, and orders or transfers you don't recognise.
- If you entered card or bank details: call the number on the card, report the phishing, and let the bank decide on monitoring or reissue. If you entered a government ID number, place a fraud alert with a credit bureau.
- Warn the people in the message's blast radius. If it came from a coworker's or friend's account, tell them via a different channel — their account may be the one that's compromised.
Expect the sequel. After a phishing click, a second message often arrives 'from security' about suspicious activity — sometimes referencing the first. Treat every follow-up as hostile: only act through the official app or the number on your card.
Spot the next one in five seconds
- Urgency + threat: 'verify within 24 hours or your account closes'.
- The sender/address is almost-right: extra words, swapped letters, or a domain that isn't the company's real one.
- It wants you to leave the app: real companies resolve things inside their own app/website, not through a texted link.
Common questions
I clicked but didn't type anything. Am I safe? Almost certainly. A web page by itself can't reach into your accounts. Close the tab, don't go back, and run a quick antivirus scan if a download started. The follow-up risk is another message pretending to be a warning about the first one.
The page looked exactly like my bank / Microsoft / Amazon. How? Phishers copy real pages pixel-for-pixel; the giveaway is the address (a lookalike domain), not the design. That's why step one below starts from the real app or a hand-typed address — never from the suspicious message.
Related