Act according to what happened after the click. Close the suspicious page, stop replying, and use a trusted device or a website, app, phone number, or contact method you already know is genuine. Clicking alone does not prove that an account or device was compromised, but entering credentials, disclosing financial details, or downloading a file creates a different level of risk.
This US-focused guide gives you the correct response for each situation: clicking without entering anything, submitting a password or verification code, giving a scammer bank or identity information, opening an attachment, or involving a work or school account.
As an Amazon Associate I earn from qualifying purchases.
First, stop the interaction and classify what happened
Do not click another link in the message, call a number it provides, reply to the sender, or continue using a page that looks suspicious. Close the browser tab or app. If the message claims that an account is locked, a payment failed, or a delivery needs attention, check the claim independently through the organization’s official app or by typing its known web address yourself.
Write down what you did while the details are fresh: the message or site involved, the time, the account used, information entered, and whether a file downloaded or opened. This record helps a bank, account provider, or IT team respond accurately.
#1 Best Overall
| What happened | Immediate priority | Who should be contacted |
|---|---|---|
| Clicked, but entered nothing and downloaded nothing | Close the page, verify the supposed issue independently, and watch for unusual account activity | The purported service only if verification is needed, using a known-good channel |
| Entered a password, username, or verification code | Change the affected password and every reused copy; enable MFA; review account activity | The account provider; work or school IT if applicable |
| Entered bank, card, Social Security, or other identity information | Call the financial institution or begin identity-theft recovery promptly | Your bank or card issuer; IdentityTheft.gov when identity theft is suspected |
| Downloaded, installed, or opened a suspicious file | Stop sensitive logins on that device, update trusted security software, and scan | IT for a work device or network; the manufacturer or trusted technical support if cleanup is unclear |
I clicked a phishing link but didn’t enter anything
Close the page without interacting with pop-ups, prompts, downloads, or “security” messages. Do not type a password, payment detail, one-time code, or personal information merely because the page requests it. The Federal Trade Commission (FTC) warns that unexpected links and attachments can lead to scams or harmful malware, so treat the event seriously without assuming that compromise definitely occurred.
Verify the claimed problem safely
Open the real service’s app or type an address you have used before. You can also use the phone number printed on a card or statement, or another independent contact method. Never use contact details supplied in the suspicious message. Check whether there is actually a billing issue, security alert, order, or account message.
Check for a download
Look in your browser’s download list and your device’s recent files. A download that you did not intentionally start changes the response: stop using the device for sensitive logins and follow the malware steps below. If nothing was downloaded, installed, or opened, continue with normal caution and monitor the relevant account.
Rank #2
I entered my password or a verification code on a fake website
Use a trusted device and go directly to the real service. Change the exposed password immediately, then change every other account that uses the same password. Microsoft Support’s phishing-response guidance states: Immediately change the passwords on all affected accounts, and anywhere else that you might use the same password.
Use a different, long password for every account; a password manager can help create and store unique credentials.
Harden the account after changing the password
- Turn on multifactor authentication (MFA) in the account’s security settings. An authenticator app or security key may be available in addition to text messages; use an option the service supports.
- Review recent sign-ins, active sessions, connected devices, forwarding rules, and third-party app access. Sign out of devices or sessions you do not recognize.
- Check the recovery email address and phone number. Remove changes you did not make and replace them with your own verified details.
- Inspect sent mail, deleted items, direct messages, and other activity for actions you did not initiate. Remove unfamiliar email-forwarding rules and revoke suspicious app connections.
- Tell contacts through another channel if the account may have sent phishing messages. Ask them not to open links or attachments from it.
If you cannot sign in
Use only the provider’s official account-recovery process. Reach it by typing the provider’s known address or using its official app, not through the original email. Preserve the incident notes you made, including the approximate time and information entered.
Work and school accounts require faster escalation
Notify your organization’s IT or security team immediately and follow its incident procedures. Do not hide the event or wait to see whether anything happens. State which account was used, what information was entered, whether a code was submitted, and whether a file was opened. The team may need to revoke sessions, reset tokens, inspect mail rules, or protect other users.
What to do if you gave a scammer bank, card, or identity details
Contact the bank, card issuer, or other financial institution promptly through the number on your card or statement, or through its official website or app. Explain exactly what information was disclosed and when. Ask what account-protection, card-replacement, transaction-monitoring, or fraud-reporting steps it requires. Do not rely on a phone number or link in the phishing message.
Recommended Free Tools
If personal information was exposed
If a Social Security number, credit-card number, bank-account details, or comparable identity information was disclosed and identity theft is suspected, use the FTC’s IdentityTheft.gov recovery service. Follow the plan it provides for the specific information lost. Do not promise yourself or anyone else a particular recovery outcome; the correct steps depend on the institution and information involved.
Watch legitimate accounts for activity you did not authorize
Review statements, transaction alerts, account messages, and credit-related notices. Save copies of the phishing message and any confirmation numbers from your bank or recovery service. If a transaction is unauthorized, report it through the institution’s official fraud channel as soon as you notice it.
Rank #4
A file downloaded, an attachment opened, or software installed
On the potentially affected device, stop logging in to email, banking, shopping, password-manager, and other sensitive accounts until you have checked it. A downloaded file can create risk even when no password was entered.
Run a trusted security scan
- Update the device’s trusted security software and its definitions or signatures.
- Run a full scan, not only a quick check, and allow the software to remove or quarantine what it identifies.
- Restart if the security software requests it, then run another scan if recommended.
- Change passwords from a separate, trusted device after the potentially affected device is assessed, especially if you used it to sign in after opening the file.
The FTC’s malware guidance, identified as April 2025, supports updating current, trusted security software and scanning when malware may have downloaded. Do not install an unfamiliar “cleanup” program offered by a pop-up or the original message.
Work or network-connected computer
If the computer is part of a work network or you believe it is infected, disconnect it from the network and notify IT. Do not email the suspicious file to coworkers or reconnect the device simply to test it. IT can preserve evidence and decide whether the device needs isolation, reimaging, or another controlled response.
When you are unsure how to clean the device
Contact the device manufacturer or a trusted technical-support provider. Explain what was downloaded or opened and what the security scan reported. Avoid anyone who demands remote access or payment through the same suspicious pop-up.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Report the phishing message, then remove it
For US consumer incidents, the FTC lists these reporting routes:
- Forward phishing email to [email protected].
- Forward a phishing text message to 7726 (SPAM).
- Report the attempt to ReportFraud.ftc.gov.
After reporting, delete the message and empty the trash or deleted-items folder if appropriate. Use your employer’s or school’s reporting route as well; organizational systems may need the original message and its headers, so follow their instructions before deleting it.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to verify a message without making the situation worse
- Open a new browser window or the official app instead of following the message link.
- Type the service’s address yourself or use a bookmark you created previously.
- Use a phone number from a physical card, statement, official bill, or the organization’s independently found website.
- Check the account dashboard for the same alert; a message visible only through the suspicious link deserves extra caution.
- Never share a one-time code with a caller or support agent who contacted you unexpectedly.
After the emergency: harden accounts and devices
Use MFA everywhere it is offered
MFA reduces the damage from a stolen password, although it cannot clean an infected device or undo information already disclosed. CISA’s phishing guidance recommends MFA and identifies secure tokens as one possible method. A physical security key is optional and works only with compatible services; it is an account-hardening measure, not a repair tool.
Adopt unique passwords
Replace reused credentials even if you have not seen suspicious activity on every account. CISA also points to password managers as a way to create and store long, strong, unique passwords. Choose a manager and recovery method you can maintain, and protect the manager account itself with MFA.
Keep software current
Install operating-system, browser, app, and security updates from their normal settings screens. Updates do not prove that a particular phishing incident is resolved, but they reduce exposure to known weaknesses while you complete account and device checks.
Quick Recap
Common mistakes to avoid
- Continuing the conversation: A scammer may use urgency, threats, or a fake support agent to obtain more information.
- Reusing the same new password: A password changed once is not enough if that password appears on other accounts.
- Calling the message’s number: It can route you directly to the attacker. Use an independently verified number.
- Logging in from the possibly infected device: Do sensitive password changes from a trusted device until scanning is complete.
- Deleting evidence before reporting: Your IT team may need the original message or technical details.
- Assuming no visible symptom means no risk: Review sign-ins, recovery settings, sent messages, and financial activity after the immediate response.
A practical decision checklist
- Close the suspicious page or message and stop responding.
- Identify whether you entered credentials, financial or identity information, or a verification code.
- Identify whether anything downloaded, installed, or opened.
- Use a trusted device or independent channel to change passwords, contact the institution, or recover the account.
- Enable MFA, review sessions and recovery details, and remove unauthorized activity.
- Scan and isolate a device if malware may be present.
- Notify work or school IT when an organizational account, device, or network was involved.
- Report the message through the FTC routes and your organization’s process, then delete it when permitted.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute
