I clicked a phishing link. What should I do?

First, the reassurance most people actually need: clicking a link, on its own, is rarely the harmful step. On a reasonably current device, loading a page does not hand anything over. The damage comes from what happens after — typing something, approving something, or opening something.

So the right response depends on which of those you did. Find your situation.

How fast you actually need to move

Not every branch below is equally urgent, and treating all of them as an emergency is its own kind of mistake — it burns the urgency you need for the branches where minutes matter. Roughly:

CISA's guidance on phishing makes the same point in general terms: the response that matters is changing any compromised credentials and watching accounts for misuse, done promptly rather than perfectly. Below, each branch is broken down against that same first-15-minutes / within-the-hour / same-day order.

If you only clicked and entered nothing

Close the tab. That is genuinely the whole response.

If you want additional reassurance, run a scan with the security software you already have, and make sure your browser and operating system are up to date. The FTC's own phishing guidance gives the same advice for a link or attachment that may have downloaded something: update your security software, then run a scan and remove anything it flags. There is no need to change passwords, and no need to keep worrying about it.

If you entered a password

This is a real incident, and speed is what determines the outcome.

First 15 minutes

Change the password on that account first. Go to the real site directly — type the address, do not use any link from the message.

Within the hour

1. Change it anywhere you reused it. Be honest with yourself about how many places that is. Start with your email account, because email is the reset mechanism for everything else.
2. Turn on two-factor authentication on the affected account and your email.
3. Review recent activity — most services show recent sign-ins, devices and locations. Sign out anything you do not recognise.

A password changed within the first ten minutes usually ends the incident entirely. If you want the longer version of this branch — including how to force an attacker out of a session they already have, and what to check afterwards — see I gave a scammer my password.

If you approved a login prompt or read out a code

Treat this as more serious than a password alone, because it likely means someone completed a login rather than just collecting a secret.

First 15 minutes

Change the password, then — this is the step people miss — use the account's "sign out of all devices" or "revoke active sessions" option. Changing a password does not always terminate sessions that already exist, and a live session is what the attacker actually wanted.

Same day

Check for changes they may have made to keep access:

• New forwarding rules or filters in your email
• Added recovery email addresses or phone numbers
• New authenticator apps or trusted devices
• Changed security questions

If you entered card details

First 15 minutes

Call your bank or card issuer now, using the number on the back of the card. Card payments are among the few genuinely reversible ones, and issuers handle this constantly — you will not be the first call today. Ask them to block the card and issue a replacement.

Same day

Watch the account for small test transactions, which often precede larger ones.

If you downloaded or opened a file

First 15 minutes

Disconnect from the network — pull the cable or turn off Wi-Fi — before doing anything else. This stops anything already installed from sending data out or receiving further instructions.

Same day

Run a full scan with your security software, and change important passwords from a different device — if there is a keylogger on the affected machine, changing passwords on it hands over the new ones too. If it is a work device, contact your IT team immediately rather than trying to resolve it yourself. Speed of disclosure matters more than looking careless, and IT teams greatly prefer an early report to a late one.

If you sent money

First hour

Contact your bank immediately — recall is sometimes possible for transfers, but the odds fall sharply once the money has settled. Report to the FTC at ReportFraud.ftc.gov and the FBI at ic3.gov in the US, or Action Fraud in the UK. The Financial Conduct Authority's scam guidance makes the same point about banking scams generally: acting before you have second thoughts talked out of you is what preserves your options.

Same day

Recovery odds depend heavily on method:

Reporting it, even if nothing happened

It takes under a minute and it is genuinely useful. UK: forward to report@phishing.gov.uk. US: ReportFraud.ftc.gov and ic3.gov. Also report inside your mail client, which improves filtering for everyone.

Research cited by the FTC found that only around 4.8% of people who experienced mass-market consumer fraud reported it to a government body or the BBB. Patterns get identified because people bother. The NCSC's own guidance on spotting scam emails, texts and calls exists for the same reason — the individual report is small, but the aggregate is what lets a fake toll-road campaign or a bank impersonation wave get named and blocked before it reaches the next person.

Afterwards

Once things are stable, the changes that stop a repeat are unglamorous and effective: a password manager so nothing is reused, two-factor authentication everywhere, and passkeys wherever they are offered — because a passkey cannot be handed to a fake site at all.

Two cases fall outside the sequence above, because neither involves typing a password. If the page told you to paste something into your computer, read CAPTCHA scams. If it asked you to approve an app's access on a genuine Google or Microsoft screen, read consent phishing — a password change does not undo that one.