Act quickly, but do not panic. Stop communicating with the sender, avoid any links or phone numbers in the message, and contact affected companies through an app, website, or telephone number you already know is genuine. Your next steps depend on what happened: clicking a link alone is different from entering a password, sharing a card number, downloading software, or granting remote access.
Use the matching section below. If more than one event occurred, follow every applicable branch, starting with device safety and account protection.
As an Amazon Associate I earn from qualifying purchases.
Do these things first
- End the interaction. Close the suspicious page or message. Do not reply, click again, download anything, or provide additional information.
- Verify independently. If the message claims to be from a bank, retailer, employer, delivery service, or government agency, open that organization’s official app or type its known web address yourself. Do not use contact details supplied in the suspicious message.
- Record what happened. Save the message, sender address or phone number, web address, screenshots, transaction details, and the approximate time. Do not forward the scam to friends or colleagues except through an official reporting route.
- Assess the event. Identify whether you only opened a link, entered credentials, disclosed financial or identity information, downloaded a file, or allowed someone to control the device. The most serious applicable category determines your next move.
- Protect other accounts from a possibly infected device. If a file was downloaded, remote access was granted, or the device is showing signs of malware, stop entering passwords or other sensitive data on it until it has been checked.
Match your response to what happened
| What occurred | Immediate priority | Use this guidance |
|---|---|---|
| Link opened, no information entered | Close it, update security software, and scan | Clicked only |
| Password or username entered | Change the password and secure every reused login | Credentials |
| Card, bank, payment, or account number shared | Call the institution through a trusted channel | Financial information |
| Social Security number or other identity data shared | Start the official identity-recovery process | Identity information |
| Program or attachment downloaded | Stop sensitive logins and scan the device | Downloaded software |
| Someone was given remote control | End access, isolate the device if needed, and get trusted technical help | Remote access |
If you only clicked the link
A click does not by itself prove that your device was infected. An unexpected link can lead to a fake sign-in page, ask for personal information, or direct you to malware. The Federal Trade Commission (FTC) recommends updating security software and running a scan after clicking an unexpected link.
- Close the tab or message and do not return to it.
- Update the device’s security software from its normal settings or the vendor’s known official site.
- Run a full scan. Follow the security program’s instructions to quarantine or remove anything it identifies.
- If the scan finds a problem, or if the device behaves unexpectedly, stop using it for banking, email, shopping, or other sensitive logins until it has been checked and cleaned.
The scan is a precaution, not a declaration that compromise occurred. Do not enter a password merely to test whether a suspicious page is real. If you entered information as well as clicking, follow the relevant account, financial, or identity section too.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you entered a password or account login
Assume the disclosed password is no longer private. Make the change from a device you trust. If the device may contain malware, have it checked first or use another known-clean device.
- Navigate to the service by typing its address or using its official app. Do not follow the message’s recovery link.
- Change the password for the affected account. Choose a new password that is not used anywhere else.
- Change the same password on every other account where it was reused. Attackers commonly try exposed credentials on other services.
- Enable two-factor authentication (2FA) in the account’s security settings. Use an authenticator app, security key, or another method the provider supports; a security key is an optional, phishing-resistant form of multi-factor authentication.
- Review the provider’s official account-recovery and session-management tools. Sign out of unfamiliar sessions and follow the provider’s instructions if you cannot log in.
If you are locked out, use only the service’s official account-recovery route. Tell the provider that the credentials were disclosed and follow its identity-verification process. Do not send one-time codes to anyone who contacts you unexpectedly.
If you shared financial details or sent money
Contact the bank, card issuer, payment provider, or merchant immediately through a telephone number on a statement or card, an official app, or a website you entered yourself. Explain exactly what was disclosed or authorized and ask what the institution wants you to do to secure the account or payment method.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Tell the institution whether you shared a card number, bank-account number, online-banking login, payment-app credential, or one-time verification code.
- Give the date, amount, recipient, and transaction reference for any payment that occurred.
- Follow the issuer’s instructions for replacing a payment method, restricting transfers, or investigating activity. Procedures differ by institution and payment rail, so there is no single universal remedy.
- Continue checking statements and account alerts for activity you do not recognize, and report anything suspicious through the same trusted channel.
The FTC directs people who believe they gave a scammer a credit-card or bank-account number to IdentityTheft.gov for a tailored recovery plan. This is U.S. federal guidance; your bank or country may have additional procedures. Do not pay anyone who promises guaranteed recovery of lost money.
If you shared identity information
Identity information can include a Social Security number, tax identifier, driver’s-license details, passport information, date of birth, or a combination of details that can be used to impersonate you. In the United States, start at IdentityTheft.gov and follow the personalized recovery steps for the information exposed.
If misuse is already suspected
Use the site’s identity-theft recovery plan and complete the actions it assigns. Keep copies of your report, correspondence, and any supporting documents. Contact organizations named in the plan through their verified contact details.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If a Social Security number was exposed but you have not seen misuse
The FTC points to IdentityTheft.gov/databreach for protective steps after a data exposure when misuse is not yet known. Follow the official instructions rather than assuming a paid monitoring service is required; the federal recovery route is available without charge.
Free tools Windows power users keep installed
One-click scans. No signup required.
IdentityTheft.gov and the related reporting services are U.S.-oriented. People elsewhere should use their national identity-theft, consumer-protection, and credit-reporting authorities.
If you downloaded a file or installed software
Treat an unexpected download as a device-security incident, even if you did not open the file. Do not use that device to enter new passwords, banking details, or other sensitive information until it has been checked.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Close the suspicious program or browser window. Do not approve additional prompts from it.
- Update the device’s security software using its normal update mechanism.
- Run a scan and remove or quarantine anything the scanner identifies. The FTC’s response guidance is direct: “Then run a scan and remove anything it identifies as a problem.”
- After the device is confirmed clean, change passwords that may have been exposed and enable 2FA. If you already changed them on the possibly infected device, change them again from a clean device.
- For help, contact the device manufacturer, a company you already know and trust, or a technically knowledgeable friend or family member. Avoid unsolicited “support” callers who offer to fix the problem.
If the security tool cannot run, the device cannot stay stable, or the infection keeps returning, stop using it for sensitive work and seek professional assistance through a trusted channel.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If you granted remote access
Remote-control software can allow another person to view the screen, operate the keyboard, and access files while the session is active. End the session using the software’s normal controls. If you cannot tell whether access has ended, disconnect the device from the internet and obtain help from the manufacturer or another trusted technician.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Do not continue a phone or chat conversation with the person who requested access.
- From a separate, clean device, change important account passwords and turn on 2FA.
- Ask a trusted technician to check for remote-access programs, unwanted user accounts, startup items, and other changes.
- Tell your bank or other affected providers that someone had remote access to the device, especially if you viewed financial information during the session.
Do not reconnect the device for normal banking or password changes until it has been checked. If remote access was granted together with a download or credential disclosure, complete all of those response branches.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
How to tell whether the device needs extra caution
Use the more cautious malware steps if a security program reports a threat, an unknown program was installed, a file was downloaded unexpectedly, someone controlled the device, or the device began behaving unusually after the event. You do not need to prove infection before pausing sensitive logins; preventing additional exposure is safer than testing the device with a real account.
Report the scam in the United States
Reporting will not guarantee that money or information can be recovered, but it helps authorities collect intelligence about scam campaigns.
| Scam type | U.S. reporting route |
|---|---|
| Phishing text message | Forward it to SPAM (7726). |
| Phishing email | Forward it to [email protected]. |
| Other scams or fraud | Submit a report at ReportFraud.ftc.gov. |
Include the sender information, suspicious web address, what you clicked or disclosed, and any payment details requested. Remove private information that is not needed for the report. These routes are U.S.-specific; elsewhere, use your country’s official cybercrime or consumer-protection reporting service and notify your bank or identity authority through verified contact details.
Common mistakes to avoid after a scam
- Do not call the number in the message. A scammer may pose as your bank, a delivery company, or technical support.
- Do not keep logging in on a questionable device. A password change made on an infected device can be captured again.
- Do not reuse the exposed password. Changing it in only one place leaves every reused account vulnerable.
- Do not delay notifying a financial institution. The issuer can tell you which protective actions apply to your account and payment method.
- Do not assume a click alone proves compromise. Scan and monitor without claiming that infection is certain.
- Do not trust follow-up “recovery” offers. Use the original institution’s verified contact details and official government guidance.
After the immediate response
Finish any account-recovery instructions, keep records of reports and reference numbers, and watch affected accounts for unfamiliar activity. Leave 2FA enabled on recovered accounts. If the incident exposed several kinds of information, maintain a written checklist so that each provider, account, and device is handled separately. The priority is to stop further disclosure, secure the device, and work through the official recovery path for your country.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
