Opened a phishing email? What to do next
Quick answer
Opening a phishing email isn't usually the problem. Clicking a link, opening an attachment or typing details is. If you only opened it, delete it. If you did more, update your security software, change passwords and report it at ReportFraud.ftc.gov.
- Last updated
How it works
The FTC says scammers use email and text messages to try to steal your passwords, account numbers or Social Security number. With those they can get into your email, bank or other accounts, or sell your details to other scammers.
Phishing emails tell a story. They look like they come from a bank, a card company, a utility or a payment app, and they might:
- say they noticed suspicious activity or log-in attempts, when they haven't
- claim there's a problem with your account or payment information
- ask you to confirm personal or financial details
- include an invoice you don't recognize
- link to a payment page that carries malware
- offer a government refund or a coupon
The FTC's own example has a generic greeting, says your account is on hold because of a billing problem and asks you to click to update your payment details.
Red flags
- A generic greeting instead of your name
- A story about suspicious activity, a billing problem or an account on hold
- A link or attachment you didn't ask for
- A request to confirm or update payment or personal information
- An invoice for something you didn't buy
- A refund or coupon that sounds too good to be true
Example message
Dear customer, we noticed a billing problem and your account is now on hold. Click [link] to update your payment details and avoid losing access.
What to do
- 1
Ask yourself if you have an account with them
If you don't have an account with the company or don't know the sender, treat it as phishing, report it and delete it. If you do, contact the company using a phone number or website you know is real, not the details in the email.
- 2
If you only opened it
Delete it. Opening is far less risky than clicking, but don't open attachments or click anything in it.
- 3
If you clicked a link or opened an attachment
Update your computer's security software, run a scan and remove anything it flags. Then change the passwords for accounts you use on that device.
- 4
If you typed in details
Go to IdentityTheft.gov for steps matched to what you shared, such as a card, bank account or Social Security number. Our guide on what to do after a data breach covers the same ground.
- 5
Turn on multi-factor authentication
It makes it harder for a scammer to log in even if they have your password.
- 6
Report it
Forward the email to the Anti-Phishing Working Group and report it at ReportFraud.ftc.gov.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Phishing emails go out by the thousand, but the better ones use your name, your bank or a store you really shop at. That information comes from data breaches and from people-search sites that list your email, phone number and address. Serus finds the data brokers and people-search sites that list your name, address and phone number and sends the removal requests, and it alerts you when your details show up in a breach, so fewer scammers can reach you.
Frequently asked
Can I get hacked just by opening a phishing email?
The FTC's advice centers on links and attachments: they can install harmful software. If you only opened the message and clicked nothing, delete it and report it.
What if I clicked the link but entered nothing?
Update your security software, run a scan and watch your accounts. Change passwords if you are unsure.
How do I report a phishing email?
The FTC says to forward phishing emails to the Anti-Phishing Working Group and report them at ReportFraud.ftc.gov. Text messages can be forwarded to 7726 (SPAM).
Where do I go if I gave away my Social Security or card number?
IdentityTheft.gov gives you steps based on the specific information you lost.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
