Act on what was exposed, not merely on the fact that you clicked. Close the suspicious page, stop communicating through the message, and use a known-good app, website address, or phone number to secure any account, payment method, or identity information involved. A page view, password entry, one-time code, financial detail, and downloaded file require different next steps.
First, identify exactly what happened
Do not click the message again to investigate. Write down what you remember while it is fresh: the sender, approximate time, page visited, information entered, prompts approved, files downloaded, and any account or transaction changes you can see. Then choose the branch below that matches the most serious exposure.
As an Amazon Associate I earn from qualifying purchases.
| What happened | Priority response | What it does not prove |
|---|---|---|
| You opened a link but entered nothing | Close it, verify the supposed issue through the real service, and watch for downloads or installation prompts. | A click alone does not establish that an account was taken over. |
| You entered a password | Change it through the genuine service, change reused copies, end other sessions, verify recovery details, and enable MFA. | It does not prove the attacker successfully signed in, but you should treat the password as exposed. |
| You shared a verification code or approved a sign-in request | Secure the account tied to the code immediately, review sessions and recovery settings, and contact official support if control is uncertain. | The code is not harmless because it expires; it may have authorized a live attempt. |
| You entered card, bank, Social Security, or other identity information | Contact the relevant institution through a verified route, inspect activity, and use IdentityTheft.gov for identity-information exposure. | An absence of an immediate charge does not guarantee that the information will not be misused later. |
| A file downloaded or software may have installed | Update legitimate security software, run a scan, follow its remediation steps, and notify workplace IT when applicable. | Not every phishing link installs malware; scan because a download or installation occurred. |
If you only opened the link
Close the page and stop using the message
Close the browser tab. Do not sign in, pay an invoice, reply, call a number in the message, or approve a notification from that page. Phishing pages often create urgency so that you continue before checking the claim.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCheck the alleged problem independently
Open the organization’s official app, type an address you already know is correct, or call a number from a statement, card, or prior correspondence. Do not use the link, phone number, QR code, or contact details supplied by the suspicious message. Look for the same alert in the real account rather than trusting the copy you were shown.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check for a download
If the page downloaded a file, offered a browser extension, or prompted an installation, move to the malware branch below. If nothing downloaded and you entered no information, continue monitoring the relevant account and be alert for follow-up messages that refer to the attempted contact.
If you entered a password
Change it from a known-good route
Navigate independently to the real service and set a new, unique password. Never change it through the suspicious page. If you used the same password anywhere else, change those accounts too; attackers routinely try stolen credentials on other services.
Secure the email account first when it is involved
Email deserves priority because it can receive password-reset links for other accounts. After changing the password, review the account’s recovery email addresses and phone numbers, sign out devices or sessions you do not recognize, and inspect recent account activity for changes you did not make.
Turn on stronger authentication
Enable multifactor authentication (MFA) in the service’s own security settings. Use an authenticator app, hardware security key, or another method the service supports. A security key is an optional physical MFA credential; compatibility differs by service. It helps prevent future sign-ins but cannot undo a password or code disclosure by itself.
Look for persistence
- Check forwarding rules, filters, delegated access, connected apps, and new recovery contacts in email or social accounts.
- Review active sessions and remove devices you do not recognize.
- Check sent messages, posts, cloud files, and payment settings for unauthorized activity.
- Warn contacts only through a separate, trusted channel if the account sent messages in your name.
If you shared a verification code or approved a sign-in
Assume the account attempt may have succeeded
A one-time password (OTP), SMS code, authenticator code, or approval notification is authentication material. The FBI’s Stay Safe Online: Simple Tips for Adults states: “Never share this code with anyone.” Stop responding to the person who requested it.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Reclaim and lock down the account
- Open the service’s official app or type its known address yourself.
- Change the password and end other sessions or sign-ins.
- Check recovery email addresses, phone numbers, MFA methods, trusted devices, and security keys for additions or removals.
- Remove unfamiliar connected applications, forwarding rules, and access grants.
- Review security notifications, messages, posts, and account changes for activity you did not authorize.
- Contact the service through its official support channel if you cannot sign in, recovery details changed, or an attacker remains present.
Financial institution codes require immediate contact
If the code came from a bank, card issuer, payment service, or brokerage—or a transfer was involved—contact the institution immediately through its verified app or a number from a card or statement. Explain that an OTP or sign-in approval may have been disclosed, ask the institution to secure the account and investigate transfers, and follow its fraud team’s instructions. The FBI’s account-takeover alert also recommends reporting fraudulent internet activity to IC3.gov.
If you entered payment or identity information
Card or bank details
Call the card issuer or financial institution promptly using a verified number or its official app. Tell it exactly what you entered and whether you approved a transaction. Ask what to do about replacing the card, blocking transfers, changing online-banking credentials, or adding monitoring. Review transactions, payees, beneficiaries, and profile changes for anything you did not make.
Social Security or other identity information
For exposed Social Security information or other identity details, use the recovery plan at IdentityTheft.gov. Follow the plan’s instructions for documenting the incident and taking protective steps. Keep checking statements, credit-related notices, insurance accounts, tax accounts, and government-service accounts for changes you did not authorize.
Do not wait for a visible loss
Fraud may not appear immediately. Preserve confirmation emails, transaction records, and case numbers from the institution, but do not revisit the suspicious message to retrieve them. Use records you already have or official account pages.
If a file downloaded or software may have installed
Disconnect only when your organization instructs you to
On a personal device, stop using the downloaded file and close the related application. On a work device, promptly notify the organization’s IT or security team and follow its incident process; do not erase evidence or install unapproved cleanup tools first. The team may need the device available for investigation.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Update and scan
Update legitimate security software and run a full scan. Follow the software’s remediation instructions if it identifies a threat. Also install pending operating-system and browser updates from their normal settings pages. Do not assume malware was installed merely because a link opened; the scan is warranted when a file, extension, or installation was involved.
Watch for continuing symptoms
- Unexpected pop-ups, new extensions, disabled security tools, or changed browser settings.
- Unknown applications, unusual battery or network use, or repeated sign-in alerts.
- Messages sent from your accounts or files changed without your action.
If symptoms continue after the scan, stop entering passwords on that device and seek qualified technical or organizational support from a trusted channel.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Report the phishing attempt and preserve evidence
Reporting can help service providers and investigators connect related attempts. In the United States, the FTC advises:
- Forward phishing emails to
[email protected]. - Forward phishing text messages to
SPAM(7726). - Submit a report at ReportFraud.ftc.gov.
The FBI directs victims of internet crime to IC3.gov. For a fraudulent financial transfer, contact the financial institution first and then submit the IC3 report as soon as practical.
Keep the original message, sender address or number, headers when available, screenshots, transaction records, and approximate times. Store them safely and do not click the message again just to collect details. If forwarding an email, avoid altering the original in a way that destroys useful headers.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Special handling for work and shared accounts
Tell your employer’s IT or security team immediately if the event involved a work account, company device, customer data, or a shared mailbox. Use the organization’s incident channel, not a phone number or link in the suspicious message. Do not conceal the event because you are unsure whether the password or code worked; early notice lets the team revoke sessions, reset credentials, inspect logs, and warn affected users.
For a personal account used to manage a business page, cloud files, or family finances, secure the account and notify other administrators through a trusted channel. Check shared recovery addresses and delegated access, not just your own password.
Prevention after the incident is contained
Make independent verification a habit
When a message claims that an account, delivery, invoice, or payment needs attention, open the service yourself. Treat unexpected requests for passwords, MFA codes, remote access, gift cards, or urgent transfers as warning signs. A legitimate support representative should not need you to read a one-time code back to them.
Reduce the damage from password reuse
Use a different password for every important account, especially email, financial services, and cloud storage. A password manager can generate and store unique passwords; protect the manager with a strong master password and MFA supported by the service.
Recommended Free Tools
Strengthen MFA thoughtfully
Enable MFA on email, financial, social, and administrator accounts. Where supported, consider an authenticator app or security key instead of relying only on text messages. Check the service’s compatibility and recovery process before replacing an existing method, and keep recovery information current.
What changes outside the United States
The FTC and FBI reporting contacts above are U.S.-focused. Elsewhere, contact the affected service and financial institution through verified channels, then use your country’s official cybercrime and consumer-protection reporting services. Account-recovery screens, session-revocation controls, fraud deadlines, and identity-protection remedies vary by provider and jurisdiction, so follow the current instructions from the organization that holds the account or funds.
Quick Recap
A concise decision checklist
- Page only: close it, verify independently, and check whether anything downloaded.
- Password: change it at the real service, change reused copies, end other sessions, verify recovery settings, and enable MFA.
- Verification code or approval: secure the linked account immediately; review sessions and recovery methods; contact official support if control is uncertain.
- Money or identity data: contact the institution promptly, inspect activity, and use IdentityTheft.gov for identity exposure.
- Download or installation: update security software, scan, follow remediation, and notify workplace IT when relevant.
- Always: preserve details safely, report through official channels, and never use contact information supplied by the suspicious message.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
