I clicked a suspicious link. What now?
It happens to careful people every day. A text about a package, an email that looks like your bank, a pop-up that says your computer is infected. You tapped, and now your stomach has dropped. Take a breath. Most of the time this is fixable, and the steps below will help.
First: what did you do after clicking?
The next steps depend on what happened after the link opened. Find the one that fits.
You only clicked, and closed the page
- Close the tab or app. Don't go back to the page.
- Make sure your phone or computer is up to date. Updates fix the security holes these pages try to use.
- Delete the message, and report it (see below).
In most cases, that's it. Simply opening a page rarely does damage on an up-to-date device.
You typed in a password
- Change that password now, by going to the real website or app yourself, not through the link.
- Change it anywhere else you use the same password. A password manager makes this much easier in future.
- Turn on two-step sign-in, so a stolen password alone isn't enough to get in.
- Check your email settings for forwarding rules or recovery details you don't recognize. Scammers sometimes add these to stay in.
You entered card or bank details
- Call your bank using the number on the back of your card. Ask them to block the card and watch for unusual payments.
- Turn on transaction alerts in your banking app.
- Consider a free credit freeze with Equifax, Experian and TransUnion if you shared your Social Security number.
You downloaded something, or let someone control your screen
- Disconnect from the internet (turn off Wi-Fi) to cut off any connection.
- Uninstall anything you didn't mean to install, especially remote-access apps a caller asked you to add.
- Run a security scan. Windows has Microsoft Defender built in. On a Mac, keep macOS updated.
- Change your important passwords from a different device, starting with email and banking.
How to tell if a Microsoft or Apple pop-up is real
Real Microsoft and Apple warnings never show a phone number to call, never ask you to pay to fix a virus, and never ask a stranger to take control of your computer. If a pop-up does any of these, it's fake.
To get rid of it, close the browser. If it won't close, press Ctrl + Alt + Delete on Windows and open Task Manager, or press Option + Command + Esc on a Mac and choose Force Quit. Then don't reopen the old tabs.
Report it
- Forward scam texts to 7726 (it spells SPAM) to alert your mobile carrier.
- Report phishing emails using the "Report phishing" option in Gmail or Outlook.
- Report fraud at ReportFraud.ftc.gov.
Want a second opinion?
If you're not sure whether a message is real, don't click anything else. Take a screenshot and send it to us. We'll tell you what we see and what to do next, in everyday words. And if a parent keeps getting caught by these messages, we can help set up protections with them, kindly and without judgment.
Common questions
Can I get a virus just by clicking a link?
It's possible, but uncommon on an up-to-date phone or computer. The bigger risks are typing in a password or card details, or downloading something the page offers.
I clicked a phishing link on my iPhone. What should I do?
Close the page and don't enter anything. If you did enter a password, change it in the real app or website and turn on two-step sign-in. Keep your iPhone updated in Settings, General, Software Update.
Should I reply STOP to a scam text?
No. Replying tells scammers your number is active. Forward it to 7726 instead, then delete it.
Who can check a suspicious email for me?
We can. Send a screenshot rather than forwarding the link, and we'll tell you whether it looks safe and what to do next.