Clicked a phishing link? What to do next
Checked by The Proofmark editorial team against our methodology before publishing
The Proofmark · Our methodology
Need the meaning first? Read the short definition.
I clicked a scam link. What should I do first?
Take a moment to recall what happened. Did you type a password, give a code, make a payment or install an app?
A click alone does not tell you whether an account was taken over. Do not ignore it, but do not assume you have lost everything.
On a computer, run a full scan with your security software. Follow its steps to remove any threat. This is part of the UK NCSC's advice after a phishing attempt.
If this happened on a work device, tell your IT team. Tell them what you clicked and what you did next.
What if I typed my password or shared a login code?
Open the real app or type the known website address. Change the password there. Change it on other accounts where you used the same one.
If you cannot get in, use that service's account recovery page. Do not use a recovery link sent by the suspect caller.
Turn on two-step login if the service offers it. This adds a check beyond your password. The FTC explains the steps for a compromised account.
Tell the service if you shared a one-time code too. A password change should not be treated as proof that all access has ended.
What if I gave my card details or sent money?
Call your bank or payment service straight away. Say what you shared, when it happened and whether money has moved.
Ask how to secure the account and whether a payment can be stopped or challenged. Do not wait for a charge to appear before reporting exposed card details.
Explain whether you made the payment yourself or someone else did. Those are different situations. Your country and payment method affect the options.
Our chargeback explainer covers one possible route for card payments. It does not apply to every transfer or guarantee a refund.
What if I downloaded something or allowed remote access?
Do not use the suspect app for banking. Ask the device maker or a trusted IT service for help checking the device.
Update your security software and scan for harmful files. On phones, follow support steps for your device. A computer scan is not a fix for every phone problem.
Use another trusted device to contact your bank if someone may still have access. Keep the app name and details of what the caller asked you to do.
What does phishing mean?
Phishing is a trick that uses a trusted name to get your details, money or access to a device. It can start with an email, text or call.
You may hear text scams called smishing and phone scams called vishing. The useful question is the same: who is really asking you to act?
A message may claim a parcel is stuck or a bank account is blocked. A familiar logo is not enough to trust it.
Check through a contact route you already trust. The FTC's phishing guide explains these warning signs and basic account protection.
Where can I report the message?
Report it to the real company being copied. Keep the message, sender details and any payment record before deleting or blocking it.
In the UK, use the NCSC's reporting routes. In the US, the FTC guide above links to its reporting service.
Elsewhere, use your country's official fraud or cybercrime reporting service. Reporting a message does not replace calling your bank about money at risk.
Not sure which step applies to you?
Request a free call. Tell us your country and whether you clicked, shared details, paid or installed an app. We can help you understand the next steps.
You do not need to know the technical terms. Keep passwords and login codes private. If money is at risk, call your bank before waiting for our callback.
Sources
Where to go in your country
Scams cross borders. The people who can do something about them do not. Choose your country below, or change it if our guess is wrong.
Choose your country to see local contacts. If it is not listed, you can ask our team for help.
🇬🇧 The United Kingdom
🔎 Check the firm
FCA Firm Checker — Search the firm name, its website, or the reference number it gave you.
🚨 Report it
Report Fraud (City of London Police) — Report online or call 0300 123 2040. In Scotland, call Police Scotland on 101.
↩ Ask for your money back
Financial Ombudsman Service — Complain to the firm first, then bring it here. Free, and it can order the firm to pay.
Every address above was opened and checked by us on 30 September 2026. Tell us if one has moved.
Was this article helpful?
Thank you. Your feedback helps us improve.
Your reason has been saved.
Your callback request is received.
Our team will call .
You do not need to send another request. The call is free.
Your reference:
Request a free callback
Leave your number. We will talk through what happened.
Name and phone number are required. All other details are optional.
Your saved draft has been restored.
More guides
Romance scams: warning signs and what to do if you paid
Is someone you met online asking for money? Learn the warning signs of a romance scam, what to do after paying, and how to ask for help.
How to check an online casino before you deposit
Check local gambling rules, the licence and withdrawal terms before you pay. If money is stuck, learn what records to keep and where to seek help.
AI trading bot scams: checks before you trust a platform
Check the firm behind an AI trading offer, its permissions and its profit claims. A small payout is not proof of safety. Learn what to do if you have already paid.
