Quick Fix: Close the suspicious page and stop interacting with it. If you entered credentials or approved a login, secure that account through its real app or website from a trusted device. If you ran an unknown file or suspect an infection, stop sensitive activity on that device and use supported recovery. Contact your bank immediately if payment details or money are involved.
Clicking a phishing link does not by itself establish an account takeover or device infection. Your response depends on whether you only visited, shared information, approved access or installed something. Keep the original message for a verified reporting channel without opening it again.
What Should You Do in the First Few Minutes?
After clicking a phishing link, stop interacting with the page and identify what happened. A fake login can steal information you enter; a harmful download or an exploited vulnerability is a different exposure. The page’s appearance does not diagnose either one.
Stop Interacting with the Page
Close the browser tab or window straight away. Don’t enter a username, password, one-time code or card number, and don’t click any buttons, pop-ups or “continue” prompts on the page.
If You Only Opened the Page
If you only viewed the page and closed it without sharing information or approving anything, the risk is generally lower than after entering credentials, but appearance alone cannot certify the device. Check downloads and site permissions, keep the browser and device updated and monitor relevant accounts. Clearing site data can remove cookies or permissions, but it does not undo a stolen password or uninstall an app.
Check for Downloads and Unexpected Permissions
Check your browser’s download bar and your device’s downloads folder for anything you didn’t intentionally save. Also check whether the page asked for permissions, such as access to notifications, location or camera, and whether you granted them. These can be used for follow-up scams or tracking.
Before deleting anything, note the file name and where it came from. This information can help you describe the incident later to your bank, your employer’s IT team or a support line.
When Should You Disconnect from the Internet?
If you opened an unknown file, installed software or suspect active device compromise, disconnect the affected device while you obtain trusted support. Use a different trusted device for account recovery. A downloaded file that was never opened is a different situation: do not run it to investigate. On a work device, report immediately and follow your security team’s containment instructions.
Closing a page without further interaction does not automatically require disconnecting every device you own. Choose the response from what happened, not from the page’s alarming wording. Reconnect an isolated device only as needed for the supported recovery process; some updates and scans require connectivity.
What If You Entered Details or Approved a Sign-In?
If you entered a password, code or payment details on a fake login page, change that password immediately and check the account for unfamiliar activity. At this point, the phishing link poses a genuine account risk because the attacker has information they may try to use.
If You Entered a Password or Verification Code
Go directly to the real website or app, not through the link you clicked, and change the password for the affected account. Use a strong, unique password, ideally generated and stored in a password manager. Update it on any other account where you reused it.
If you approved a login prompt or entered a verification code on the fake page, review active sessions and recovery details in the real account settings. Revoke unfamiliar access using supported controls. Where offered, a FIDO security key or passkey can provide phishing-resistant authentication. An authenticator’s typed one-time codes can still be phished; they are not the same protection as FIDO. See CISA’s authentication guidance.
Caution: changing a password does not always end a session an attacker has already started. Where the account settings allow it, sign out of all active sessions to close that gap.
Check the Account Beyond Its Password
Use the provider’s real recovery process if you cannot sign in. For a Google account, Google’s compromised-account guidance covers recent security events, unfamiliar devices, recovery details and connected access. For Gmail, also review forwarding, filters and delegation you did not set up. A changed password alone does not demonstrate that those settings are safe.
Review the account’s own device/session controls. Google explains that several sessions can belong to one device and that background syncing can update the displayed time. Inspect the details instead of treating every duplicate name as an attacker or every familiar name as proof of safety. Use the provider’s supported sign-out and security steps for access you cannot recognise.
If you granted a third-party app access rather than entering a password, review that connection too. Check which account you authorised and what access it received; removing a browser tab does not revoke it. For a work or school account, tell the administrator what you approved so they can assess the organisation’s controls.
If You Shared Payment or Personal Information
If you entered card details, contact your card issuer to flag possible fraud and ask about replacing the card or blocking transactions. Watch your statements closely over the following weeks, as fraudulent charges may not appear immediately.
If you shared information that could enable identity theft, use recovery guidance for your country. In the US, IdentityTheft.gov provides identity-theft reporting and a recovery plan; the FTC also directs uncertain data-exposure cases to its data-breach guidance. A US credit freeze restricts access to your credit report; a fraud alert asks businesses to take extra identity-verification steps. These are different controls, and neither reverses an existing fraudulent transaction. Outside the US, contact the relevant local authority and financial providers rather than assuming US reporting or bureau procedures apply.
If You Used a Work Account
Tell your IT or security team as soon as possible if the phishing link involved a work email, login or device. Reporting it quickly gives your organisation’s incident response process the best chance of limiting the damage. This includes cases that could escalate into business email compromise, where an attacker uses a compromised work account to send fraudulent requests to colleagues or clients.
Don’t try to fix it yourself before reporting it. Delaying a report to avoid an awkward conversation is a common reason a single click can become a wider incident.
What If a File Downloaded or Your Device Seems Affected?
If an unexpected file downloaded, do not open it to see what it does. Note its name and use the device’s established security tools or trusted support. If you ran software, granted remote access or see signs of compromise, stop sensitive activity there and use a different trusted device for account recovery. A download that was never opened is a different situation from a running program.
Contain a Suspected Infection Before Using the Device for Account Recovery
Don’t reset passwords or log into banking, email or work accounts from a device you suspect is infected. A keylogger or other spyware running in the background could capture the new password as soon as you type it, undoing the point of changing it.
Use a different, trusted device, such as another phone or computer, to change passwords while you deal with the suspected infection on the affected device.
Run an Appropriate Scan on Windows or Mac
On Windows, open Windows Security or your established security product directly and follow its scan and removal guidance. On a Mac, follow the installed security software or Apple’s support guidance for the specific warning; macOS has built-in protections, but it does not offer the same user-facing Windows Security scan. Do not install a scanner promoted by the suspicious page.
If the scan finds something, follow its removal or quarantine recommendation rather than deleting files manually. Manual removal can miss related components that ransomware or spyware may have installed elsewhere on the system.
Check an iPhone or Android Device Without Rushing to Reset It
On Android devices with Google services, open Play Protect directly through Google Play and review installed apps and sensitive permissions. Google explains the app checks and removal warnings it provides. On iPhone, check for unexpected apps and configuration changes through trusted settings and support. Do not assume all iPhones are limited to App Store distribution: Apple documents region-dependent alternative distribution. A third-party iPhone app cannot perform a Windows-style scan of all other apps.
A factory reset removes data you may not have backed up, so treat it as a later step rather than an immediate reaction. First, try a scan and review your installed apps and permissions. Only consider a reset if problems persist and a security professional recommends it.
How Can You Report the Attempt and Reduce Further Risk?
Reporting the phishing message helps the platform block it for others and can support any recovery process you’re going through. It also gives you a record if you need to dispute charges or explain what happened to your bank or employer.
Report the Message Through the Relevant Service or Workplace Channel
Most email providers and messaging apps have a built-in option to report phishing or junk messages. Reporting helps their spam filters identify similar attempts. If the phishing link arrived by text message (smishing) or phone call (vishing), report it to your phone carrier and consider blocking the sender.
If you’re in the US and money, personal data or identity theft is involved, you can also report it to ReportFraud.ftc.gov. If a work account was involved, use your employer’s designated phishing reporting channel rather than deleting the message. The original can help IT trace how it got through.
Watch for Account Misuse and Follow-Up Scams
Check your bank and card statements, email sent folder and account activity logs over the following weeks, not just on the first day. Some attackers wait before using stolen details. A successful phishing attempt can also lead to a second-wave scam, such as a fake follow-up message claiming to help you “secure” the same account.
Be wary of unsolicited calls or messages that refer to the incident. Scammers sometimes use a successful phish to make a second attempt more convincing through social engineering.
Keep Separate Account, Payment and Device Follow-Ups
For an account incident, keep the provider’s recovery confirmation and review alerts through the real account interface. For a payment incident, keep the bank or payment provider’s case reference and follow its dispute instructions. For a device incident, note the security product’s finding and action. These outcomes answer different questions; a clean scan does not reverse a payment or end an attacker’s account session.
Tell a bank or payment company immediately if you sent money, and ask what reversal or refund options apply. The FTC’s response guidance directs people to the provider used for the payment; recovery is not guaranteed. Use a known app, statement or card number rather than a number in the suspicious message.
Treat unsolicited “recovery specialists” cautiously, especially anyone asking for an advance fee or another transfer to release your money. If a genuine provider contacts you about the case, independently open its established support channel before sharing sensitive information. Keep evidence in a private record and do not post passwords, codes or full payment details in a public scam report.
Make Future Phishing Attempts Less Likely to Succeed
A password manager helps avoid password reuse. FIDO-based passkeys and security keys can resist phishing by binding authentication to the legitimate service; an ordinary typed code can still be relayed to an attacker. Passkeys may be synced or device-bound depending on the provider. Keep a supported recovery route and do not assume changing the password automatically ends every existing session.
If phishing attempts are frequent at work, ask whether your employer offers security awareness training. It can teach staff to spot the signs of a phishing email before they click. You can read more about spotting fake messages in coverage of the LinkedIn Smart Links phishing campaign and the Instagram backup code phishing scheme, both of which show how convincing these messages can look.
Match Your Next Step to What Happened
The right response depends on what you did on the page, not on how alarming the message looked. If you closed a page without interacting with it, make a quick check and stay alert. If you entered a password, approved a login or downloaded a file, change passwords, check sessions and consider running a malware scan.
Prioritise the affected action: contact the bank for a payment incident, secure an exposed account from a trusted device, and obtain device support if software ran or a warning persists. The FTC’s scam-response guidance separates payment, account and device recovery. Keep checking account activity and beware of unsolicited recovery services asking for another payment.
Choose the Recovery Task That Matches the Exposure
Frequently Asked Questions
What if I clicked a phishing link but closed it immediately?
Close the page, check for downloads or permissions you granted, and keep software updated. No further interaction generally means less exposure than sharing a password, but it is not a certificate that nothing happened.
Am I hacked if I clicked on a link?
A click alone does not establish account takeover or infection. Check whether you entered information, approved access or installed something, then follow the relevant recovery steps.
Should I change every password after clicking a phishing link?
Prioritise exposed accounts and reused passwords. From a trusted device, also review sessions, recovery details, connected apps and any unfamiliar email forwarding or filters. Use the provider’s recovery process if you cannot sign in.
Can a malicious page exploit a device without an opened file?
Browser or operating-system vulnerabilities can create risk without an obvious installation. Keep software updated and seek trusted support for persistent warnings; do not infer a diagnosis from a webpage’s claim.
Should I reset my phone after clicking a phishing link?
A reset is not the routine first response. Review the exposure, installed apps and permissions and use platform-appropriate recovery. A reset erases local data and does not reverse stolen account information.
Sources
Guidance checked 10 November 2026: Google compromised-account recovery, Google devices and sessions and FTC scam-response guidance. For future messages, use our phishing-email checks before acting on a request.
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.