Act according to what happened: opening a suspicious link by itself does not mean your device is infected. If you entered a password, change it and any reused versions; if you exposed payment details, contact your bank or card issuer; if you downloaded or installed something, scan the device with updated, legitimate security software. Work account or device? Tell your IT or security team promptly.
First, identify what happened
Before taking action, work through the incident. The steps differ depending on whether you only opened a link, entered information, downloaded a file, or installed software.
As an Amazon Associate I earn from qualifying purchases.
- Did you only open the page, or did you type or submit information?
- Did you enter a password, personal identifier, or payment details?
- Did a file download, or did you install an app, browser extension, or other software?
- Can you still access the account, and have you noticed unfamiliar activity?
- Was this a work account or device?
If you only opened the link
If you did not enter personal information, download a file, or install software, the UK National Cyber Security Centre (NCSC) says it is “unlikely you need to take further action.” Stay alert for unexpected account notifications or messages about password changes, sign-ins, or transactions. Do not assume that a click alone means your device is infected or that you need to buy security software. NCSC: suspicious emails and what to do.
Recommended Free Tools
If you entered a password
- Go to the service directly. Use its official app or type its known web address yourself; do not use links from the suspicious message.
- Change the exposed password promptly. If you used the same password on other accounts, change it on each of those accounts too.
- Turn on two-factor authentication (2FA) for the account if you can still access it. 2FA adds another barrier if someone has your password, though it does not replace changing a compromised password. CISA: use strong passwords and enable MFA.
- Check account activity and recovery details for unfamiliar sign-ins, changes to the recovery email or phone number, or other activity you did not authorize.
If you cannot sign in
Use the service’s official account-recovery process. Find it through the provider’s app or by navigating to its official website independently—not through the suspicious message. After regaining access, change the password, sign out other devices or sessions, enable 2FA, verify recovery details, and review recent activity. If the account may have sent messages to other people, alert your contacts so they can avoid suspicious links. The FTC provides recovery guidance for hacked email and social accounts: FTC: hacked email or social media account.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you entered payment or other personal details
Payment card or bank information
Contact your bank or card issuer promptly using a trusted phone number, official app, or the number on your card—not contact details from the suspicious page or message. Ask what protections are appropriate, and review your account for unfamiliar transactions. For a business incident involving an exposed card, the FTC advises contacting the issuer, canceling and replacing the card as appropriate, and checking statements. FTC: phishing guidance for small businesses.
Identity information
If you shared other personal identifiers, use the official identity-theft support service for your country. In the United States, if you exposed your Social Security number, the FTC directs people to IdentityTheft.gov. The right recovery route depends on the information exposed and your location.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
If a file downloaded or you installed software
Update legitimate security software and run a scan; follow its instructions to remove or quarantine anything it identifies. A scan is a practical response, not proof that a device is clean or a guarantee that an incident is resolved. The FTC recommends scanning and removing identified problems, and the NCSC advises a full scan in relevant cases. FTC: how to recognize and avoid phishing scams and NCSC: suspicious emails and what to do.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11If the device is behaving as if it may be compromised, avoid entering passwords or doing banking on it until it has been checked and cleaned. Seek help from a trusted technical support provider if you need it. For an infected business computer, FTC guidance says to disconnect it from the network while it is checked.
If the account or device belongs to work
Tell your organization’s IT or security team promptly if you entered work credentials, opened a suspicious link on a work device, or downloaded or installed anything there. Follow your employer’s incident instructions; the exposure may affect more than your own account or computer. NCSC phishing guidance and FTC small-business phishing guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Report the message or loss through official channels
Reporting options depend on your country. In the United States, the FTC accepts fraud reports at ReportFraud.ftc.gov; suspected phishing emails can be forwarded to [email protected], and suspicious texts can be forwarded to 7726. If you are in the United Kingdom, use the NCSC’s phishing-reporting route; if you lost money, follow the NCSC’s guidance for contacting the relevant police service. NCSC: what to do if you receive a suspicious email.
Quick Recap
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
