Clicked on a phishing link? What to do in the next hour
Quick answer
If you clicked a phishing link but entered nothing, you're probably fine: close it and update your security software. If you typed a password, card or Social Security number, change passwords, call your bank, and follow the FTC's steps at IdentityTheft.gov.
- Last updated
How it works
Phishing messages tell a story to get you to click: a problem with your account, a missed delivery, a prize or survey. The click takes you to a look-alike website that asks for a login, card number or other details, or a link that can install harmful software.
What matters is what happened after the click. The FTC separates three cases: you only clicked, you gave information (a password, card number or Social Security number), or you downloaded something that may have installed malware. Each has different steps.
If the scammer gets a login or card number, the FTC says they may use it to reach your email, bank or other accounts, or sell it to other scammers.
Red flags
- An unexpected text or email with a link about a delivery, account problem, prize or survey
- A look-alike website asking for a password, card number or Social Security number
- A page that asks you to pay a small 'fee' to fix a problem
- A download or attachment you didn't ask for
- Pressure to act right now
Example message
Your package couldn't be delivered. Confirm your address and pay the small redelivery fee at [link] within 24 hours or it will be returned.
What to do
- 1
Close the page and don't enter anything more
If you've only clicked, close the page. Don't reply to the message.
- 2
Update your security software and scan
The FTC says to update your device's security software, run a scan and remove anything it flags. Turn on automatic updates.
- 3
If you typed a password, change it now
Create a new, strong password on that account and anywhere you reused it. Turn on two-factor authentication. If you're locked out, use the company's own recovery steps.
- 4
If you entered card or bank details
Call your card issuer or bank using the number on your card, report fraud and ask them to refund or block any charges.
- 5
If you gave your Social Security number
Go to IdentityTheft.gov for a recovery plan based on what you shared.
- 6
Report the message and delete it
Forward texts to 7726 (SPAM), emails to reportphishing@apwg.org, and report to the FTC.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Scammers need your name, number and often your address before a message feels believable. They get them from people-search sites, data brokers and breach dumps, then buy or trade the lists. Serus finds the data brokers and people-search sites that list you and removes you from them, and it alerts you when your email or phone number shows up in a breach, so fewer scammers can reach you. Nothing stops every scam message, but a smaller public footprint means a smaller target list. See how data brokers get your data.
Frequently asked
Can I get hacked just by clicking a link?
The FTC warns that links and attachments can install harmful software. If you think you downloaded something, update your security software, scan and remove anything it finds.
I clicked but entered nothing. Am I safe?
Likely, but be careful. Close the page, update your security software and watch your accounts.
What if I entered my password?
Change it right away on that account and any account where you reused it, and turn on two-factor authentication.
Where do I report it?
Forward texts to 7726 (SPAM), emails to reportphishing@apwg.org, and report at ReportFraud.ftc.gov.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
