What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Stay calm and find out what happened after the click. Opening a phishing page alone does not prove that a device is infected or an account is compromised; the urgent response depends on whether your family member entered information, downloaded or opened a file, approved a sign-in request, or shared a verification code. Stop using the message, then follow the recovery path that matches the facts.
First, stop the interaction and establish the facts
Tell your family member not to click the message again, reply to it, call a number shown in it, or continue using the page. Close the browser tab or message. Do not use links in the suspicious communication to “verify” anything. The Federal Trade Commission (FTC) advises contacting a company through a phone number or website you already know is genuine, not through details supplied by the message. See the FTC phishing guidance.
As an Amazon Associate I earn from qualifying purchases.
Ask four concrete questions before deciding what to do next:
- Did they type a password, username, card number, bank detail, Social Security number, or other personal information?
- Did the page ask them to approve a sign-in prompt or provide a one-time verification code?
- Did a file download, and was it opened or installed?
- Did anything unusual happen afterward, such as account alerts, unfamiliar messages, redirects, or system errors?
Record the service involved and the approximate time. That information helps the legitimate provider or bank investigate without requiring anyone to revisit the phishing page.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose the response that matches what happened
| What happened | Priority action | What it means |
|---|---|---|
| Only opened the page | Close it, do not return, keep software current, and watch for account alerts or device symptoms. | A click alone is not proof of infection or account takeover. |
| Entered a password or account details | Use a known-safe device or route to the real provider, change the password, and start the provider’s recovery process if necessary. | The credentials may be in the scammer’s hands, especially if reused elsewhere. |
| Entered card, bank, Social Security, or other identity information | Call the relevant institution using a trusted number or site and explain exactly what was disclosed. | The institution and the type of information determine the remedy. |
| Downloaded or opened a file, or the device acts strangely | Pause sensitive logins on that device, update security software, run a scan, and remove what it identifies. | Malware is possible, but symptoms require investigation rather than an automatic conclusion. |
| Lost access to email or social media | Use the provider’s official recovery flow, then review sessions, recovery details, forwarding, and sent messages. | An unrecognized login, changed password, or unauthorized messages can indicate takeover. |
What if they clicked but didn’t enter anything?
If the page was opened and nothing was typed, downloaded, opened, approved, or shared, explain that the click by itself does not establish compromise. Close the page and keep the operating system, browser, and security software up to date. Continue watching the relevant accounts for unauthorized activity and the device for new symptoms.
The FTC describes phishing links as routes to requests for information or malware; it does not say that every click infects a device. There is no reliable percentage that can tell you the chance of infection from a click alone. Treat the absence of further activity as reassuring, not as a reason to revisit the page or enter information later. Guidance on warning signs and cleanup is available in the FTC malware article.
What if they entered their password?
Change the exposed password through the real service
From a device you believe is safe, open the provider by typing its known address or using a bookmark you created previously. Do not follow the phishing link. Change the password immediately. If the same password was used on other sites, change it there too, giving every account a unique password.
If the provider will not accept the password or the user is locked out, use only its official account-recovery process. The FTC’s hacked-account guidance covers recovery for email and social-media accounts.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check what an intruder may have changed
After access is restored, sign out other devices and sessions where the provider offers that control. Turn on multi-factor authentication (MFA). Verify that the recovery email address and phone number still belong to your family member. Inspect email-forwarding rules, filters, recent sent messages, and deleted items. An attacker who adds forwarding or sends messages can continue operating even after a password change.
Warn contacts if the account sent messages your family member did not write. Tell them not to click unexpected links or respond to money requests. Give special attention to the email account: control of email can provide password-reset routes into other services.
What if they entered card, bank, Social Security, or other identity information?
Contact the bank, card issuer, government service, or other relevant company through a phone number printed on a card or statement, a saved bookmark, or a website address you already know is genuine. Explain exactly what information was entered and when. Do not use a number or link from the phishing message, even if the message claims to be from that institution.
Do not assume that every disclosure requires the same remedy. The institution may recommend actions specific to the account or information involved. For U.S. exposure of Social Security, bank, or card information, the FTC directs consumers to IdentityTheft.gov, which provides a recovery plan tailored to the information lost. These reporting and recovery routes are U.S.-specific; people elsewhere should use their country’s official identity-theft and financial-fraud services.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What if a file was downloaded or the device behaves strangely?
Pause sensitive activity on that device
If a file downloaded, especially if it was opened or installed, stop signing in to banking, shopping, email, and other sensitive accounts on that device until it has been checked. If another trusted device is available, use it for password changes and financial calls.
The FTC’s recommended sequence is direct: If you think you clicked on a link or opened an attachment that downloaded harmful software, update your computer’s security software.
Then, as the FTC says, run a scan and remove anything it identifies as a problem.
Follow the security software’s quarantine or removal instructions and restart if it requests one.
Recognize warning signs without treating them as proof
Possible signs listed by the FTC include unrequested browser redirects, new toolbars, repeated system errors, disabled system tools, or emails and messages the person did not send. These signs justify investigation; none alone proves that a particular file caused the problem.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsNever call a phone number displayed in a pop-up and never grant a pop-up caller remote access. If scanning does not resolve the behavior, contact the device maker, a support company your family already trusts, or a knowledgeable technician using contact details obtained independently. The FTC’s malware guidance explains this trusted-help approach.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What if they approved a sign-in prompt or gave a verification code?
Tell the provider, through its official site or app, that an unauthorized sign-in may have been approved. Change the password, end other sessions, verify recovery details, and enable MFA if it is not already active. A code or approval can be as important to report as a typed password, because it may have allowed a sign-in at that moment. If the account is inaccessible, use the provider’s recovery process rather than trying the suspicious message again.
Check for the same takeover indicators described above: unfamiliar logins, a username or password change the user did not make, inability to sign in, and messages sent to friends without permission. Notify contacts after recovery so they can ignore follow-up scams.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What if they lost access to email or social media?
Start with the service’s official recovery instructions. If malware is suspected, keep security software current and scan as described above while pursuing recovery from a safer device. Once control returns, sign out other sessions, replace the password with a unique one, confirm recovery email and phone details, inspect forwarding and sent items, and activate MFA.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Tell friends and family that the account was compromised and that unexpected links or requests for money should be ignored. This warning matters even if the provider has restored access, because contacts may still trust messages sent during the takeover.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
How to report the phishing attempt in the United States
After preserving any details needed for account or bank support, report and delete the message. The FTC lists these channels in its phishing guidance:
- Forward phishing email to [email protected].
- Forward suspicious text messages to 7726 (SPAM).
- Report the attempt at ReportFraud.ftc.gov.
- For exposed Social Security, bank, or card details, use IdentityTheft.gov for a tailored recovery plan.
These are U.S. channels. In another country, use the local consumer-protection, cybercrime, and financial-fraud reporting services. Reporting does not replace changing an exposed password or calling a bank; complete the recovery action first when an account or payment detail is at risk.
The FTC reported in a 2025 consumer alert that email was the top method scammers used to contact people in 2024. The alert gives that ranking but no count or percentage, so it should not be read as a measure of the risk from any individual message.
Recommended Free Tools
Prevent the next incident
Use stronger account defenses
Use a different password for every important account and turn on MFA wherever the provider supports it. MFA makes access harder when a scammer has only a password. Available factors can include a code, an authenticator app, a biometric check, or a physical security key. The FTC names a security key as one possible credential; it is optional and useful only when the account supports that method.
Before buying a hardware key, check the account’s compatibility and its recovery process if the key is lost. A key is not an emergency purchase for someone who merely clicked a link, and the FTC does not rank one MFA method or product as best.
Keep devices and recovery information ready
- Install operating-system, browser, and security-software updates promptly.
- Maintain backups so important files can be recovered if a device is damaged or compromised.
- Review account recovery email addresses and phone numbers periodically.
- Teach family members to open a company’s app or type its known address instead of using an unexpected message link.
- Agree on a simple family rule: pause, ask another person, and verify through a known-good channel before entering credentials or payment details.
When to seek specialized help
This guidance is general consumer triage, not device-specific forensic analysis. Exact recovery and cleanup steps vary by provider, operating system, device, and information disclosed. Seek trusted technical help when malware symptoms persist after updating and scanning, when an account cannot be recovered through its official process, or when a financial institution instructs you to take additional protective measures. Keep using independently verified contact details, and never let a pop-up or caller dictate where you get help.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
