Recommended Free Tools
Act based on what happened after the click. Opening a suspicious page does not by itself prove that your email was hacked or that malware was installed. The urgent steps are to identify what you entered or approved, change any exposed password through your provider’s legitimate app or website, revoke unfamiliar access, inspect account activity and mail settings, and contain any information shared.
Do not return to the message to “fix” the problem. Open the email service through its official app, a bookmark you already trust, or an address you type manually. If you entered payment details, downloaded a file, or use a work or school mailbox, follow the additional branches below.
As an Amazon Associate I earn from qualifying purchases.
1. Establish exactly what the click exposed
Before changing settings, make a quick incident record. Write down the approximate time, which account was involved, the message or sender, the page you visited, anything you typed, and whether a file downloaded or an access prompt appeared. Microsoft recommends recording what information was shared and where when you suspect successful phishing (Microsoft Support).
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Classify the event into the closest case:
- Page viewed only: You opened the link and did not type information, download a file, or approve a prompt. A click alone does not establish that credentials were stolen or that the device is infected.
- Credentials or personal data entered: This includes an email password, one-time verification code, security-question answer, phone number, address, identity document details, or payment information.
- File downloaded or opened: Treat this as a possible device-security incident as well as an account incident, especially if the file ran or the device began behaving unusually.
- Permission approved: An “Allow,” “Continue,” or consent screen may have granted an application access to mail, contacts, files, or account data. This can remain effective after a password change.
If you are unsure which case applies, use the more protective branch: change the password, enable multifactor authentication, review sessions and connected applications, and check mail settings. Those actions do not require you to assume that compromise occurred.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. If you entered a password, code, or other secret
Change the password from a trusted route
Open your provider’s official account page or mobile app independently of the suspicious message. Navigate to the account security or password area and set a completely new, unique password. Do not reuse a variation of the exposed password, and do not use a password supplied by the suspicious page.
Change the same password anywhere else it was reused. Prioritize accounts that can be reset through this email address, hold financial information, or protect work systems. Microsoft advises changing affected and reused passwords immediately; Google gives the same direction for a suspected account-access event (Microsoft Support, Google Account Help).
A password change stops someone who only has the old password from making a new sign-in, but it is not a complete cleanup if an attacker already created a session, changed recovery details, or received an application token. Continue through the access-review steps rather than treating the reset as the end of the incident.
Change an exposed one-time code in context
A one-time code can authorize a sign-in or an account change even though it expires. If you entered one, inspect recent security events immediately and sign out sessions you do not recognize. If the code was for a bank, payment service, workplace system, or another account, use that service’s official recovery process as well as securing the email account that may receive future codes.
Check the recovery methods
In account security, inspect the recovery phone number, recovery email address, backup codes, passkeys, and other sign-in methods. Remove or correct anything you did not add. An unfamiliar recovery address can let another person reset the password later, while missing recovery options can leave you locked out after you sign out other sessions.
3. Turn on multifactor authentication and choose a practical method
Enable multifactor authentication (MFA) after setting the new password. MFA adds another verification step when a password is used. CISA describes it as an additional layer that helps prevent unauthorized access when credentials are compromised (CISA: More than a Password).
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Providers differ in which methods they support. Compare the choices on your account’s own security page rather than assuming every service offers every option.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute| Method | Phishing resistance | Recovery and backup considerations | Practical trade-off |
|---|---|---|---|
| FIDO2-compatible hardware security key | Strongest option in the CISA comparison because the key verifies the legitimate site | Keep a spare key or another supported recovery method; losing the only key can block access | Requires carrying and registering a physical device, and the provider must support it |
| Authenticator application | Stronger than a password alone, but codes can still be entered into a phishing page | Save the provider’s backup codes and confirm how the app can be restored if the phone is lost | Works without cellular service on many accounts, but requires a functioning enrolled device |
| SMS code | Provides an extra step but is less preferable than a security key or authenticator application in CISA’s guidance | Keep the phone number current and maintain another recovery route | Easy to deploy, but dependent on mobile service and vulnerable to number-transfer attacks |
CISA states, “MFA helps prevent unauthorized access, even if credentials are compromised, making it one of the most effective ways SLTTs can protect operations and public safety.” That is guidance for state, local, tribal, and territorial government organizations, not a promise that MFA blocks every form of account takeover (CISA: Four Cybersecurity Essentials).
A FIDO2 hardware key is an optional longer-term upgrade, not a prerequisite for immediate recovery. First secure the account with whatever supported MFA method you can activate, then add a second recovery method if the provider permits it.
4. Review sign-ins, devices, sessions, and connected applications
Inspect recent security events
Use the provider’s security dashboard to review recent sign-ins, password changes, recovery-setting changes, and alerts. Look for activity after the suspicious click and for actions you do not remember making. Sign out of unfamiliar devices or sessions using the provider’s built-in control.
Do not treat a location or timestamp alone as proof of compromise. Google notes that background communications can update a session and that one device can create multiple sessions, so assess the device details, browser, time, and action together (Google compromised-account guidance). If the evidence remains unclear, sign out the questionable session and sign in again through the official app.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Revoke unfamiliar application access
Open the connected-apps or third-party access section of account security. Remove applications you do not recognize, no longer use, or did not intentionally authorize. Pay particular attention to an app that appeared immediately after the suspicious link.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
This matters even when you already changed the password. The FBI Internet Crime Complaint Center’s 2026 public service announcement explains: “OAuth consent phishing provides actors with persistent access to a target’s account because once permission is obtained, it can only be revoked by the victim invalidating the token in their application security settings; not by changing the password.” Revoke the permission in the provider’s application-security controls (FBI IC3, 2026).
When an application has access to mail or cloud files, assume that information available during the authorization window may have been exposed. Change passwords for other services whose reset links or data were accessible through the mailbox, and notify the affected service if sensitive information was involved.
5. Check email-specific settings for hidden persistence
An intruder may change mail behavior without changing the visible password. Inspect the following areas from the provider’s official settings interface:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Forwarding addresses and automatic forwarding rules
- Filters or rules that delete, archive, label, or redirect security messages
- Delegated mailbox access
- Scheduled messages and automatic replies
- Outgoing display name, reply-to address, and other send-as addresses
- Blocked addresses and spam controls
- IMAP, POP, or other mail-client access
For Gmail, Google specifically lists delegation, forwarding, filters, scheduled emails, automatic replies, outgoing address or name, blocked addresses, and IMAP/POP access as areas to inspect when investigating suspicious activity (Google account activity guidance). Remove unfamiliar entries, correct altered settings, and save each change.
Check the Sent folder for messages you did not write, Trash or deleted-mail folders for missing correspondence, and replies from contacts who received unexpected messages. A malicious filter can hide warnings, so search the mailbox for security notifications and review the provider’s alert history as well.
These menu names are not universal. For a non-Gmail service, use that provider’s official compromised-account checklist and security pages rather than copying Gmail instructions. Work and school mailboxes may be centrally managed; notify the organization’s IT or security team promptly so administrators can review tenant-wide rules, tokens, and audit logs.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. If a file downloaded or ran, address the device separately
Do not assume that opening a link infected the device. Take the device branch when a file downloaded, an attachment or installer was opened, a script was allowed to run, browser extensions appeared, or the computer or phone began behaving unusually.
- Disconnect the device from sensitive work or financial services while you assess it. Do not enter new passwords on a device you suspect is actively compromised; use a different trusted device to change the email password and enable MFA.
- Install pending operating-system and browser security updates from the system’s normal settings, not from a pop-up in the suspicious page.
- Run a scan with trusted, up-to-date security software. Google includes trusted antivirus software and reviewing unfamiliar browser extensions among device-security steps for a potentially compromised account (Google compromised-account guidance).
- Review browser extensions, installed applications, and download history. Remove items you did not install or no longer need, then restart the device.
- If symptoms continue, preserve the suspicious file and relevant timestamps for your organization’s IT team or a qualified incident-response professional rather than repeatedly opening the file.
A paid antivirus or cleanup service is not automatically required merely because you clicked a link. Escalate when the device shows persistent symptoms, security tools are disabled, files are encrypted, or an administrator identifies malicious activity.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Report the message and contain downstream damage
Report the phishing message
Use the email service’s built-in “Report phishing” or equivalent control, then delete the message. Reporting helps the provider investigate the campaign and removes the lure from your mailbox. Do not forward the suspicious link to coworkers or friends unless your security team requests the original message for analysis.
Notify the right organization
For a work or school account, contact IT or the security team even if you believe you only viewed the page. Administrators may need to invalidate sessions, remove an application grant, search for forwarding rules, and warn other users.
If you entered a card number, bank details, payment password, or government-identity information, contact the relevant institution using a phone number or website address you verify independently. Ask what to replace, freeze, monitor, or dispute. Microsoft recommends contacting financial providers when payment or bank information was shared (Microsoft Support).
If money was lost or identity theft occurred, report it to local law enforcement and follow the affected institution’s fraud process. Keep your incident notes, transaction records, message headers, and confirmation numbers.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
8. What to do when you cannot sign in
If the new password fails, recovery information changed, or MFA codes no longer arrive, stop trying links in the original message. Use the provider’s official account-recovery route from a manually entered address or its legitimate app. Provide the requested identity and account-history details, and use a device and network you commonly use when the provider asks for them.
For an organization-managed mailbox, the administrator may be the only party able to reset MFA, revoke tokens, or restore access. Tell IT exactly what you entered, when you entered it, and whether you approved an application. Do not conceal the event because you fear disciplinary consequences; delayed reporting gives an intruder more time to read mail or impersonate you.
9. Harden the account after the immediate incident
Adopt distinct credentials
Use a different password for every important account, especially accounts that can reset one another. A password manager can generate and store distinct credentials, but it is an aid to prevention, not a substitute for the incident steps above. Keep the manager’s recovery method protected and test that you can access it before relying on it.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteKeep recovery options current
Store backup codes in a protected place, maintain a current recovery address and phone number, and review those details after changing devices or employment. Remove old numbers and addresses that another person could control.
Consider a phishing-resistant key
After access is stable, consider registering two compatible FIDO2 hardware security keys: one for daily use and one stored securely as a spare. Confirm that your provider supports the key, that your phone or computer has the required connector or wireless capability, and that you understand the provider’s recovery process if both keys are unavailable. This improves resistance to fake sign-in pages but does not eliminate risks such as malicious authorized applications or a compromised recovery account.
Quick Recap
10. A concise decision checklist
- Only viewed the page: Report and delete the message, then review security events and connected applications if the page requested a sign-in or permission.
- Entered a password or code: Change it through the official provider, change reused copies, enable MFA, inspect recovery methods, sessions, applications, and mail rules.
- Approved an application: Revoke its access in application-security settings; a password change alone may leave its token active.
- Downloaded or ran a file: Secure the account from a trusted device, update the operating system and browser, scan the device, and investigate extensions or applications.
- Shared financial or identity information: Contact the institution through independently verified details, monitor or freeze affected accounts, and report losses or identity theft.
- Used a work or school account: Notify IT or the security team immediately, even if you are not sure compromise occurred.
- Lost access: Use the provider’s official recovery route and involve the administrator for a managed account.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
