The text said your bank locked your account. Your heart did the thing it does, and your thumb did the thing it does — you tapped the link before your brain finished reading. The page loaded, something felt wrong, and now you’re staring at your phone with that cold feeling spreading through your chest. Take a breath. You’re not the first person this happened to today, not by a long stretch, and the next ten minutes matter far more than the last ten seconds. If you’re wondering what to do if you clicked a phishing link, this guide is the triage plan: what to do right now, in what order, on your phone or your computer.
The short version of what may have just happened: the link likely opened either a fake login page built to capture anything you type, or a page that tried to start a download — malware dressed up as an “update” or “document.” Clicking alone usually doesn’t hand over your accounts; typing into the page or installing what it offered is where the real damage happens. That distinction decides your next moves, and most of them take less than two minutes each.
Minute 0–2: Stop the Bleeding
Do these in order, right now, before you read further:
- Don’t type anything. If the page is asking for a password, card number, or code — stop. Close the tab or the browser window entirely. Every field you fill is a field the scammer receives.
- Stop any download that started. If your browser began downloading a file when you tapped, cancel it immediately. Check your downloads folder and delete the file — don’t open it “to see what it is.” Opening it is the mistake the download was designed to produce.
- Disconnect from the internet. Turn on airplane mode or switch off Wi-Fi. If something malicious did get onto your device, cutting its connection stops it from sending your data back to the attacker or spreading to other devices on your network. You can reconnect once you’ve scanned and secured things.
- Take a screenshot of the page and the original message. Capture the URL, the message text, and the sender. You’ll need these for reporting later, and scam pages disappear fast.
That’s the first two minutes. Nothing you do after this can undo those steps, and skipping them to panic-Google “am I hacked” is the most common way people make things worse. You’re already ahead of most victims.
What to Do If You Clicked a Phishing Link on Your Phone
Phones are where most phishing links get clicked, and the playbook is slightly different from computers:
- Close the browser tab and clear it. On iPhone (Safari) or Android (Chrome), close the tab that opened the link. If the page asked you to install a “profile,” a configuration file, or an app from outside the App Store/Play Store — and you did — delete it now, then restart the phone.
- Check what you granted. Go to your phone’s settings and review recently installed apps and profiles. On iPhone: Settings → General → VPN & Device Management. On Android: Settings → Apps. Anything you don’t recognize that appeared today gets removed.
- Update your phone’s software. Install any pending OS and browser updates. The FTC’s standing advice for clicked links is direct: update your security software and run a scan. On phones, the OS update is the security software update.
- Run a security scan if you have a mobile security app. If you don’t have one, your phone’s built-in protections (Google Play Protect on Android, Apple’s built-in malware defenses on iPhone) cover the common cases — but only if the software is current, which is why step 3 comes first.
- Reconnect, then watch. Turn Wi-Fi back on and monitor your accounts — email, banking, social — for login alerts or unfamiliar activity over the next few days. Most carriers and banks will notify you of new sign-ins; don’t ignore those notifications this week.
On a Computer: The Extra Cleanup Steps
Computers face one risk phones mostly don’t: real malware that digs in. If you clicked on a desktop or laptop:
- Run a full antivirus scan with updated definitions — not a quick scan, a full one. Let it finish.
- Check your browser extensions. Phishing pages sometimes trick people into installing malicious extensions. Remove anything you didn’t deliberately install, especially anything added today.
- Check email forwarding rules and filters. This is the step everyone forgets and attackers love: if you entered an email password anywhere, the intruder may have set up silent forwarding so they keep receiving your mail — including password-reset emails — even after you change the password. Look in your email settings for forwarding addresses and inbox rules you didn’t create, and delete them.
- Review connected apps and sessions. In your Google, Apple, or Microsoft account security page, review signed-in devices and third-party apps with account access. Revoke anything unfamiliar.
If You Typed Anything: Password Triage Order
Clicking is one thing; typing is another. If you entered credentials into the phishing page, treat those credentials as compromised — because they are. Change them in this order:
- Email first. Your email is the master key: password resets for nearly everything flow through it. Change it now, on the real site (address typed by you), to a strong unique password.
- Banking and payment apps second. Then check recent transactions for anything you didn’t authorize.
- Everywhere you reused that password third. The American Bankers Association’s guidance is blunt: change compromised passwords right away and don’t use them for any other accounts. Attackers automate “credential stuffing” — trying your stolen password across hundreds of sites within minutes.
- Turn on two-factor authentication everywhere it matters — email, banking, social accounts. An authenticator app beats SMS codes, and the FTC recommends two-factor authentication as standard protection after any account compromise. Also check that your recovery email and phone number haven’t been changed by the intruder.
Banking Lockdown: When Money Could Be at Risk
If you entered card numbers, bank login details, or a Social Security number, skip the wait-and-see approach:
Call your bank or card issuer immediately — use the number on the back of your card, not any number from the suspicious message. Tell them you entered details into a phishing page. They can freeze the card, issue a replacement, and flag the account for fraud monitoring. Do this before you finish reading the rest of this guide if you haven’t already.
If you entered your Social Security number, visit IdentityTheft.gov — the FTC’s recovery portal — which builds a personal recovery plan based on exactly what information was exposed. Consider placing a fraud alert with the credit bureaus and think hard about a credit freeze, which is free and is the strongest protection against new accounts being opened in your name.
Watch statements daily for the next month, not monthly. Small test charges — a dollar or two — are how criminals check whether stolen card details work before the big purchase. Report anything unfamiliar the moment you see it.
Watch for the Second Wave: Follow-Up Scam Attempts
Here’s what surprises people: the phishing link is often just the opening. Once scammers know you’re responsive, expect follow-ups:
- “Tech support” calls or pop-ups claiming your device is infected and offering to fix it — for remote access to your computer or a fee. Real tech companies don’t cold-call about infections.
- Fake fraud-department calls from “your bank,” referencing the incident to sound legitimate, asking you to “verify” details or read back a one-time code. Hang up and call your bank’s real number.
- Recovery scams — someone contacts you claiming they can get your money back, for an upfront fee. Nobody legitimate charges victims upfront to recover stolen funds.
- More phishing using details from the first attack to sound convincing. Stay skeptical of urgent messages for the next few weeks, even ones that reference real facts about you.
The rule for all of these: you don’t trust inbound contact about the incident. If your “bank” calls you, you hang up and call the number on your card. Every time.
When and How to Report
Reporting takes five minutes and it matters — your report becomes part of the data law enforcement uses to track campaigns:
- Forward phishing texts to 7726 (SPAM) and phishing emails to reportphishing@apwg.org (the Anti-Phishing Working Group).
- FTC: ReportFraud.ftc.gov — file a report with the details and screenshots you captured.
- FBI: ic3.gov — especially if you lost money or entered financial details.
- The impersonated company: most banks and major companies have a phishing-report address (often phishing@companyname) — a quick search on their real site finds it.
The Bottom Line
Clicking a phishing link feels catastrophic in the moment, but it’s a solvable problem with a clear order of operations: stop interacting, disconnect, clean the device, change passwords starting with email, lock down banking if money details were exposed, and report it. The people who get hurt worst aren’t the ones who clicked — it’s the ones who clicked and then did nothing for a week, hoping it would be fine. You read this guide instead. Now go do the first four steps.
Sources
- Norton LifeLock, “What happens if you click on a phishing link?” — https://lifelock.norton.com/learn/fraud/what-happens-if-you-click-on-a-phishing-link
- Norton, “Clicked on a phishing link? Here’s what to do” — https://us.norton.com/blog/online-scams/i-clicked-on-a-phishing-link
- American Bankers Association, “Phishing: Don’t Take the Bait” — https://www.aba.com/news-research/analysis-guides/phishing-dont-take-the-bait/
- Bob’s Computer Repairs, “Changed the Password? The Phishing Attack May Not Be Over” — https://www.bobscomputerrepairs.com/you-changed-the-password-the-phishing-attack-may-not-be-over/
- 24-7 & West Wisconsin Telcom, “How to Recognize & Avoid Phishing Scams” — http://wwt.net/blog/how-to-recognize-phishing-emails/
Last reviewed: October 2026
This article is for education only and is not financial or legal advice.