What to do if you clicked a phishing link, step by step

If you clicked a phishing link, what to do depends on what happened next. If you only opened the page, close it and you are probably fine. If you typed a password, change it now from a different tab and sign out other sessions. If you entered card details, call your bank. If a file opened, scan the device.

Most advice on this hands everyone the same nine steps. That wastes the time of the person who only glanced at a page, and it buries the urgent step for the person who typed a bank password. Find your row first.

What exactly happened after you clicked?

Then read the section below that matches.

I clicked but did not enter anything

This is the most common case and usually the least harmful. A phishing page is built to collect what you type. If you typed nothing, it collected nothing of value.

Do three things. Close the tab. Check that your browser and operating system are up to date, since updates are what protect a device from a page that tries to do more than ask questions. And watch whether anything downloaded: look in your Downloads folder, and delete any file that arrived without you asking for it. Do not open it.

The page may have learned that your address is active and roughly where you are, the way any website does when you visit. Expect more phishing aimed at you, and treat the next one with the same suspicion.

I entered my password

Move fast, in this order.

1. Open a new tab and go to the real site yourself. Type the address or use a bookmark. Do not go back through the email.
2. Change the password. Microsoft's guidance is to "immediately change the passwords on all affected accounts, and anywhere else that you might use the same password."
3. Sign out other sessions. Most services have a "sign out of all devices" option in security settings. If the attacker logged in during the minutes before you changed the password, this removes them.
4. Turn on two-factor authentication if it was off.
5. Check what changed. Look at recovery email and phone, and for an email account, at forwarding rules and filters. Google's guide to securing a compromised account lists the settings to review.

If the password was for your Apple Account, Apple's instruction is the same: if you "might have entered your password or other personal information on a scam website," change the password immediately and make sure two-factor authentication is enabled.

If it was your email password, do the full cleanup. Whoever controls your inbox can reset your other accounts.

I entered a code or approved a sign-in prompt

Treat this as a completed break-in, even though two-factor authentication was on. Modern phishing pages pass your password and your code to the real site within seconds, which signs the attacker in. A code typed into a fake page, or a push prompt approved while that page was open, is spent.

Change the password, sign out every session, then go through the account's security page: remove devices you do not recognize, remove any new sign-in method or recovery option, and check for forwarding. Codes you can type will always be open to this trick. Passkeys and security keys are not, which is the main reason to move to them. We compare the methods in is two-factor authentication safe.

I entered card, bank or ID details

Call your bank or card issuer using the number printed on the card or a statement. Tell them the details were entered on a fraudulent site. They can block the card, issue a new one and watch for charges. Microsoft's phishing guidance says the same: if you shared card or bank information, contact those companies to alert them to possible fraud.

For identity details, the FTC's advice is specific: "If you think a scammer has your information, like your Social Security, credit card, or bank account number, go to IdentityTheft.gov," which builds a recovery plan based on what was lost. If money is gone, report it to local police as well. Microsoft suggests writing down every detail you remember while it is fresh, because the report will ask for it.

I downloaded or opened a file

This is the case where the device itself may be affected. The FTC's malware guidance gives the order:

1. Immediately stop logging in to online accounts on that device, especially shopping and banking.
2. Update your security software, or install some if you have none.
3. Run a scan and remove what it finds.
4. Change your passwords and turn on two-factor authentication, in case the malware captured logins.

Do step 4 from a different device you trust. If someone talked you into installing a remote access program so they could "help", uninstall it, disconnect that computer from the internet, and treat every account you used on it as exposed.

I clicked "Allow" on a permission screen

Some phishing never asks for a password. It sends you to a real Google or Microsoft sign-in page and then asks you to grant an unfamiliar app access to your mail or files. Changing your password may not cancel that grant.

In a Google Account, open the linked apps page, select the app under Access to your Google Account, and choose Remove access. Other providers have an equivalent list of connected apps in their security or privacy settings. Remove anything you do not recognize.

It happened on a work device or work account

Tell your IT or security team right away, before you start changing things. Microsoft's guidance is that if an attack affects your work or school accounts, you should notify IT support. They can see sign-ins you cannot, reset sessions centrally and warn colleagues who received the same message. Reporting quickly is what limits the damage.

Should I disconnect from the internet?

Only in one situation: when something was downloaded and run, or a stranger has remote access. Disconnecting stops software on the device from talking to whoever sent it.

If you typed a password into a web page, going offline does nothing useful. The password has already been sent, and you need a connection to change it. For that case, speed matters more than unplugging.

Can a phone get infected just by clicking a link?

On an up-to-date iPhone or Android phone it is unlikely. Phishing aimed at ordinary people works by getting you to type, approve or install something, not by breaking into the phone on contact. The realistic risks on a phone are the same as in the table: a password typed into a fake page, a card number, or an app or profile you were talked into installing. If you installed something, remove it. If you typed something, follow that section. Then install any waiting system update.

What was that email, anyway?

Once the urgent part is done, you can examine the message without opening it again or loading anything in it.

1. On a computer, get the original source of the email. In Gmail, click the three dots next to Reply, choose Show original, then Copy to clipboard.
2. Paste it into Secria's free email tracker checker and click Check email. The checker reads the message as plain text, so no image or link in it can load. It reports whether the email carried a tracking pixel, which would have told the sender you opened it, and whether its links carried your email address or a code unique to you.
3. Paste the same text into the email header analyzer to see whether the sender's address was forged. A DMARC fail means the company it claimed to be from did not send it.

Both run in your browser and upload nothing. The result is useful when you report the message, and it tells you whether the sender already knows your address is live.

Report it, then delete it

• In your mail app: in Gmail, the three dots next to Reply, then Report phishing. In Outlook, Report, then Report phishing.
• In the US: forward the email to reportphishing@apwg.org and report it at ReportFraud.ftc.gov. Forward phishing texts to 7726.
• To the company that was imitated, through the contact page on its real site.

CISA's advice after reporting is short: delete the message, and do not reply or click anything in it, including an unsubscribe link.

What should I watch for afterwards?

For the next few weeks, keep an eye on:

• Sign-in alerts and password reset emails you did not request.
• Card and bank statements, including small test charges.
• Messages that mention the incident and offer to "help you recover". Scammers do come back to people who were caught once.
• Friends saying they got odd messages from you.

Frequently asked questions

I clicked a phishing link but did not enter any information. Am I safe?

Most likely. Close the page, make sure nothing downloaded, and install pending updates. The page gained little beyond knowing your address is active. No password change is needed unless you typed one.

Do I need to change all my passwords?

No. Change the one you typed and any account that shares it. Change everything only if you opened a file or installed software, since malware can capture whatever is typed or saved on the device.

Does opening a phishing email cause harm on its own?

Rarely. If your mail app loads remote images, a tracking pixel can tell the sender the message was opened and from roughly where. That confirms your address is in use. It does not give access to your account. A tracking pixel is a tiny hidden image, and loading it is what sends the signal.

How long after clicking am I at risk?

A stolen password can be used within minutes, which is why changing the password comes first. Card details can be used days or weeks later. Once the password is changed, sessions are signed out and the card is replaced, that incident is closed.

The short version

Match what happened to the table, do the first action in that row, and only then worry about the rest. If you want fewer of these messages reporting back in the first place, Secria Mail removes tracking pixels automatically and senders never see your IP address.