You Clicked a Phishing Link — What to Do Now
First: don't panic. Clicking a bad link is far more common than people admit, and in many cases nothing harmful happens from the click alone. What matters most is what you do in the next few minutes — so work through these steps calmly and in order.
Just opening a link usually can't empty your account on its own. The real risk begins if you went further — entered a password or details, downloaded a file, or approved a login. The steps below cover both cases, starting with the most important.
Do these steps now
Don't enter anything on the page
If a login screen or form opened, close it without typing a thing. Don't enter your username, password, card details, or any code. If you were mid-way through typing, stop and close the tab.
Disconnect if a file started downloading
If the link tried to download or install something, don't open it. Delete the file, and if you're worried it ran, disconnect from Wi-Fi or mobile data to stop anything communicating out, then run a scan with your device's security software.
If you entered a password, change it immediately
Go to the real website or app (type the address yourself — don't use the link) and change your password. If you reuse that password anywhere else, change it there too, because attackers will try it across other sites. Better still, switch to a unique password for each account.
If you shared a code, card details, or paid — call your bank
If you entered an OTP, card number, or made a payment, contact your bank straight away using the number on the back of your card. Ask them to block the card and watch for or reverse any transactions. Speed genuinely matters here.
Turn on two-factor authentication
For the affected account — email, bank, social media — enable two-factor authentication (2FA) if it isn't already on. Even if a scammer has your password, 2FA stops them logging in without the second step.
Watch for follow-up scams
Once your details are out, you may get "we noticed suspicious activity" calls or texts — often the same scammers, now posing as your bank's fraud team to extract more. Treat every unexpected follow-up with the same caution. Real fraud teams won't ask you to move money or share codes.
Not sure if the link was actually dangerous?
Paste it into our free Phishing Link Checker. It shows you the link's true destination and flags fake or lookalike domains — without you having to open it again.
Check the Link →Then check if your data was exposed
If you think a password may have been caught, it's worth checking whether that password or your email has turned up in a known data breach. Our Breach Checker tells you using a privacy-preserving method that never transmits your actual password. If it shows up, change it everywhere you've used it.
Finally, take a breath. Acting quickly on the steps above resolves the large majority of cases with no lasting harm. And you now know the tell for next time: an unexpected message that hurries you toward a link is the warning sign itself — when in doubt, don't tap, and check the link first.
Frequently Asked Questions
Is my phone hacked just because I clicked a link?
Almost never from the click alone. Opening a web link typically just loads a page. Phones are hard to compromise without you installing something or granting a permission. The real risk comes from what you do next — entering details, downloading a file, or approving a login — which is why the steps above focus on those.
I only clicked, I didn't type anything. Am I fine?
In most cases, yes — but do two quick things to be safe: close the page without interacting with it, and keep an eye on the related account over the next few days. If you're unsure what the link was, run it through a phishing link checker so you know exactly what it was trying to do.
Should I do a factory reset?
Usually not necessary for a simple link click. A reset is a heavy step reserved for cases where malware was actually installed and a security scan can't clean it. Start with the steps above; escalate to a professional or a reset only if a scan finds something it can't remove.
How do I avoid this next time?
Never tap links in unexpected messages, and reach companies by opening their official app or typing the address yourself. When a link looks even slightly off, check it first with our Phishing Link Checker. And learn the common tells — our guide on spotting a scam text covers them.
This guide is general information to help you act quickly, not professional security advice. If money has been taken or you believe your identity is at risk, contact your bank and your local cybercrime authority.