Is this a phishing email?

Home / I clicked a phishing link

I clicked on a phishing link. What now?

What you need to do depends on how far it went. Find your case below and work through it now.

First: close the page, and do not type anything more into it. If someone is on the phone with you because of that email, hang up.

I only opened the email

Opening and reading a phishing email in a current mail app is very unlikely to cause harm. Do not click anything in it, report it as phishing and delete it.

I clicked the link but entered nothing

In most cases nothing has happened. The page exists to collect what you type.

  • Close the tab.
  • If a file was downloaded, delete it without opening it.
  • Run a scan with the security software your device already has, such as Microsoft Defender on Windows.

I entered a password

  1. Change that password nowGo to the real website by typing its address yourself, not through the email.
  2. Change it everywhere you reused itScammers try a stolen password on other services within minutes. Start with your email account, because it can reset all the others.
  3. Sign out other devicesMost services have a setting to sign out all sessions. Use it, then check that the recovery email and phone number are still yours.
  4. Turn on two-step loginWith it, a stolen password alone is no longer enough.

I entered card or bank details

  1. Call your bank or card issuerUse the number on the back of the card. Ask them to block the card and send a new one.
  2. Go through your recent transactionsDispute anything you do not recognise.
  3. Keep watching your statementsSmall test charges often come before a large one.

I opened an attachment or installed something

  1. Disconnect the device from the internetTurn off Wi-Fi or pull the cable.
  2. Run a full scanUse the security software on the device and remove what it finds.
  3. Change your passwords from a different deviceStart with email and banking.
  4. If someone had remote access, get the device checkedA repair shop can check for software left behind.

I sent money or gift card codes

  1. Contact your bank or the payment service immediatelyAsk whether the payment can be stopped or reversed. The sooner you call, the better the chance.
  2. For gift cards, call the card companyTell them the card was used in a scam and keep the card and receipt.
  3. Report itIn the US, report to the FTC at reportfraud.ftc.gov and to the FBI at ic3.gov.

If your personal details are out

If you gave your Social Security number or other identity details, the FTC’s IdentityTheft.gov gives you a recovery plan for your case.