I Clicked a Phishing Link: What to Do Now (Phone or Computer)

Tapped a link in a text, email or Facebook message and now think it was a scam? Close the page and take a breath. Your next steps depend on what happened after you clicked. Here’s what to do in each case, on a phone or computer, and how to report it.

I clicked on a phishing link. What do I do?

Don’t type anything else into that page. The FTC describes two ways scam links cause harm: a fake website that steals what you type, or harmful software that takes your information without you realizing it. So start with what you did:

What you did after clicking	Do this first
Only opened the page	Close it, update your device and report the message.
Typed a password	Change it on the real site or app, and anywhere you reuse it.
Typed card or bank details	Call your bank or card issuer, using the number on your card or statement.
Typed your Social Security number or date of birth	Go to IdentityTheft.gov and freeze your credit.
Downloaded something or let someone connect	Stop logging into accounts on that device, then update it and run a scan.
Entered a one-time code	Contact that company right away and change your password.

Did more than one? Follow each section that applies, or use the scam recovery checklist.

If you only opened the page

Accidentally tapped a link in a spam text and closed it without typing anything? Do this:

1. Close the page. If it shows a virus warning with a phone number, don’t call it. The FTC says to never call a number in a pop-up window.
2. Update your phone or computer. Operating system updates often include critical patches against security threats, the FTC says.
3. Run a security scan if your device has security software, and remove anything it flags (FTC).
4. Watch for signs of malware the FTC lists: a device that slows down or crashes, a browser that redirects you, lots of pop-up ads, or messages you didn’t write going out from your accounts (FTC).
5. Report the message (see below).

If you typed a password

A fake login page can hand your username and password to scammers (FTC). Act now:

1. Change the password. Go to the real site or app yourself, not through the link. Create a new, strong password, and change it anywhere else you use the same one (FTC).
2. Turn on two-factor authentication, so a password alone isn’t enough to log in.
3. Sign out of all devices, and check that the recovery email and phone number are yours. On an email account, delete any forwarding rules you didn’t set up (FTC).
4. Locked out? The FTC links to recovery pages for popular services. If it was your email account, see what to do if your email was hacked.
5. Check for changes. On a financial or shopping account, look for charges you don’t recognize or changes like a new address (IdentityTheft.gov).

If you entered card or bank details

Call your card issuer or bank now, using a number you know is real, like the one on the back of your card or on your statement (IdentityTheft.gov).

• Card number: Ask the issuer to cancel the card and send a new one, then review your transactions. More: I gave a scammer my credit card number.
• Bank account or online banking login: Tell your bank. IdentityTheft.gov advises closing an exposed account and opening a new one. More: I gave a scammer my bank account number.

Can I get my money back?

It depends on what happened and how fast you report it.

• Card charges you didn’t make. If you still have the card, the FTC says you aren’t responsible for unauthorized credit card charges. With a debit card, that’s true if you report within 60 calendar days after your statement is sent.
• Money moved with your login or a texted code. If someone tricked you into sharing that information and then moved money out, the CFPB says the transfer is unauthorized under Regulation E, a federal rule. Report it to your bank within 60 days after it sends the statement that shows it.
• Money you sent yourself. That rule covers transfers someone else started. See what to do after paying a scammer.

If you gave your Social Security number or date of birth

If a scammer has your Social Security number or other personal details, the FTC says to go to IdentityTheft.gov for steps based on what you lost.

• Already misused? If someone opened an account or made a purchase in your name, report it at IdentityTheft.gov to get a personal recovery plan.
• Not used yet, or not sure? Follow IdentityTheft.gov’s steps for lost or stolen information. They start with checking your free credit reports at AnnualCreditReport.com and freezing your credit.
• Freeze your credit at Equifax, Experian and TransUnion. It’s free and doesn’t affect your credit score, the FTC says. See How to freeze your credit and the credit freeze tracker.

Full steps: I gave a scammer my Social Security number and A scammer has my personal information.

If you downloaded something or let someone connect

If you installed something or let a stranger connect to your device:

1. Stop logging into accounts on that device, especially banking and shopping (FTC).
2. Update your security software, run a scan and delete anything it flags (FTC).
3. Remove what you installed. See the phone and computer steps below.
4. Then change your passwords and turn on two-factor authentication (FTC).
5. Need help? The FTC suggests the device’s maker, a tech support company you know and trust, or a knowledgeable friend or relative (FTC).

If someone controlled your screen, see I let a scammer into my computer.

If you entered a one-time code

A texted or emailed code works like a deadbolt on top of your password. With your bank’s code, the FTC warns, scammers can log into your account and transfer all the money out of savings or investment accounts.

1. Contact that company right away, using a number you trust, like the one on your statement or in its app (FTC).
2. Change your password and sign out of all devices (FTC).
3. Check the account for anything you didn’t do, like a new email address, phone number or device, or money moved (IdentityTheft.gov).

Remember the FTC’s rule: “Anyone who asks you for your account verification code is a scammer.” More: Is this call really from my bank?

I clicked on a phishing link on my phone (iPhone or Android)

The steps above apply to phones too. Here’s what differs.

On an iPhone

• Update iOS: Settings > General > Software Update (Apple). In April 2026, Apple warned that tapping a malicious link on out-of-date iOS could expose your data in certain web attacks; updated iPhones weren’t at risk from those attacks.
• Typed your Apple Account password? Change it immediately and make sure two-factor authentication is on, Apple says.
• Spam calendar events? In Calendar, tap Calendars, tap the info button next to the spam calendar, then Delete Calendar or Unsubscribe (Apple).
• Installed a “profile”? Apple warns some downloads install configuration profiles that can control your device. In Settings > General > VPN & Device Management, delete any profile that isn’t supposed to be there (on a work or school phone, ask IT first) (Apple).
• Report the text: tap Report Junk under the message. If it pretended to be Apple, email a screenshot to reportphishing@apple.com (Apple).

On an Android phone

• Update Android: Settings > System > Software updates (Google).
• Check Google Play Protect (Play Store > profile icon > Play Protect). It’s on by default, checks for harmful apps, including ones from outside the Play Store, and may remove them (Google).
• Installed an app from the link? Uninstall it. If your phone then freezes, crashes or runs slow, Google suggests restarting in safe mode (how varies by phone) and removing recently downloaded apps one by one (Google).
• Typed your Google password? Change it immediately, along with any site where you use the same password (Google).
• Report the text in Google Messages: touch and hold the conversation, then tap Block > Report spam > OK (Google).

I clicked on a phishing link on my computer

• Work or school computer or account? Tell your IT team right away, as Microsoft advises.
• Run a scan. On Windows, open Windows Security and select Virus & threat protection > Quick scan (Microsoft).
• Remove programs you don’t recognize, and reset your browser if pop-ups or redirects keep coming back. Google’s Chrome Help shows how on Windows and Mac.
• Write down what happened and what you typed. Microsoft says it helps if you report to police (Microsoft).
• Report the email: forward it to reportphishing@apwg.org (FTC). In Outlook, choose Report > Report phishing (Microsoft).

I clicked on a phishing link on Facebook

Facebook warns that one fraudulent link can lead to scammers taking over several accounts, like your email, Facebook and WhatsApp.

If you typed your login on the page, Facebook’s help center says to:

1. Report your account as compromised at facebook.com/hacked, even if you can still log in.
2. Reset your password if you can still log in, and remove logins or devices you don’t recognize.
3. Review your activity log, and delete posts you didn’t make.
4. Contact your bank if you think someone got into your financial accounts or made payments.

Then tell friends and family not to click links from you and to ignore requests for money (FTC). Facebook also asks you to report phishing emails to phish@fb.com.

Locked out, or did the hacker change your email? See what to do if your Facebook was hacked.

How to report a phishing link or spam text

“The information you give helps fight scammers,” the FTC says.

1. Spam text: forward it to 7726 (SPAM) to help your wireless provider spot and block similar messages. The FCC says most carriers support this, so check with yours.
2. Phishing email: forward it to the Anti-Phishing Working Group at reportphishing@apwg.org (FTC).
3. FTC: report it at ReportFraud.ftc.gov. The FTC can’t resolve individual reports, but uses them to investigate and bring cases.
4. FBI: if you lost money or someone broke into your accounts, also file with the Internet Crime Complaint Center (IC3), the FBI’s hub for reporting cyber-enabled crime.
5. Identity theft: if someone used your information, report it at IdentityTheft.gov.
6. Police: if you lost money or your identity was stolen, Microsoft advises reporting it to local law enforcement.
7. Older adults and caregivers: the National Elder Fraud Hotline, 833-FRAUD-11 (833-372-8311), assigns a case manager to help you report it. It’s open weekdays, 10 a.m. to 6 p.m. Eastern.

The report-a-scam tool lists the official channel for each kind of scam.

Watch for the follow-up scam

Scammers buy, sell and trade lists of people who have already been scammed, the FTC says. Watch for:

• A “fraud department” call. Hang up and call the number on your card or statement, never one a caller gives you.
• Requests for a code or password. Apple says it will never ask for your password or two-factor authentication code. Meta says its representatives never ask for passwords or payment details over chat or email.
• “Recovery” offers. Government agencies and legitimate organizations never ask for money to help you get a refund, the FTC says.
• Fake FBI or FTC contacts. IC3 says it will never directly contact you for information or money. The FTC will never tell you to transfer your money to “protect it”.

What varies

• Your device. Menus depend on the phone maker and software version.
• Your bank or card issuer. Claim steps differ, so ask what applies and note every call.
• Work devices. Apple advises asking your system administrator before deleting apps or profiles on a school or business device.
• What you shared. A card number can be replaced. In most cases, you can’t get a new Social Security number without evidence that someone is misusing yours (IdentityTheft.gov).