Clicked a phishing link on your iPhone? What to do next
Quick answer
Clicking a phishing link on your iPhone doesn't mean you're hacked, but stop using the page. If you typed in a password or card number, change it and call your bank now. Report the message at ReportFraud.ftc.gov and forward texts to 7726.
- Last updated
How it works
A phishing message pretends to be a company or agency you know, such as a bank, a delivery service or a toll agency. It urges you to act and includes a link. The link goes to a page that looks real and asks you to sign in or pay, which hands your details to the scammer.
The FTC says opening a link in an unexpected text or email can expose you to scammers, even if you don't type anything. The real damage usually comes after: entering a password, a card number, a Social Security number or a bank login on the fake page.
So what matters is what you did after the tap. If you only opened the page and closed it, the risk is lower. If you entered anything, treat that information as stolen.
Red flags
- An unexpected text or email about a problem with an account, a package or a payment
- Pressure to act right away or something bad happens
- A link whose address doesn't match the company's real website
- A page that asks for a password, card number or Social Security number
- A sender you don't recognize, or a message that doesn't use your name
Example message
We detected unusual activity on your account. Confirm your details within 24 hours to avoid suspension: [link]
What to do
- 1
Close the page and stop
Don't enter anything more, and don't tap other links in the message. Don't call a number the message gave you.
- 2
Check with the company the real way
If you're worried about the account, use the company's real app or a website you already trust, or a phone number you know is correct.
- 3
If you typed a password, change it everywhere
Change it on that account first, then on any other account that uses the same password. Turn on two-step verification.
- 4
If you entered card or bank details, call the bank
Use the number on the back of the card. Report fraud, ask for a new card and dispute any charges you don't recognize.
- 5
If you gave a Social Security number or ID details
Go to IdentityTheft.gov for a recovery plan and consider a credit freeze. Our guide to what to do after a data breach lists the steps.
- 6
Update your iPhone and scan for problems
Install the latest iOS update and remove any app or profile you don't recognize. The FTC also advises updating your security software and running a scan.
- 7
Report it
Forward scam texts to 7726 (SPAM), forward scam emails to ReportPhishing@apwg.org and report it at ReportFraud.ftc.gov.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Phishing messages are sent in bulk, but the convincing ones use your name, your bank or your carrier, which scammers can buy or look up. Names, phone numbers, emails and addresses sit on people-search sites and in data breaches. Serus finds where your details are listed and removes them, and alerts you when your email shows up in a breach, so fewer scammers have what they need to target you.
Frequently asked
Can I get hacked just by tapping a link on my iPhone?
The FTC says opening a link in an unexpected message can expose you to scammers, even if you enter nothing. The bigger risk is what you type into the page afterward.
I didn't enter anything. What should I do?
Close the page, delete the message and report it. Keep iOS up to date and watch your accounts for anything unusual.
I entered my password. How fast do I need to act?
Right away. Change the password on that account and anywhere you reused it, and turn on two-step verification.
Where do I report a phishing text?
Forward it to 7726 (SPAM) and report it at ReportFraud.ftc.gov. For phishing emails, forward them to ReportPhishing@apwg.org.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
