I clicked a phishing link. What should I do?

First, the reassurance most people actually need: clicking a link, on its own, is rarely the harmful step. On a reasonably current device, loading a page does not hand anything over. The damage comes from what happens after — typing something, approving something, or opening something.

So the right response depends on which of those you did. Find your situation.

If you only clicked and entered nothing

Close the tab. That is genuinely the whole response.

If you want additional reassurance, run a scan with the security software you already have, and make sure your browser and operating system are up to date. There is no need to change passwords, and no need to keep worrying about it.

If you entered a password

This is a real incident, and speed is what determines the outcome.

1. Change the password on that account first. Go to the real site directly — type the address, do not use any link from the message.
2. Change it anywhere you reused it. Be honest with yourself about how many places that is. Start with your email account, because email is the reset mechanism for everything else.
3. Turn on two-factor authentication on the affected account and your email.
4. Review recent activity — most services show recent sign-ins, devices and locations. Sign out anything you do not recognise.

A password changed within the first ten minutes usually ends the incident entirely.

If you approved a login prompt or read out a code

Treat this as more serious than a password alone, because it likely means someone completed a login rather than just collecting a secret.

Change the password, then — this is the step people miss — use the account's "sign out of all devices" or "revoke active sessions" option. Changing a password does not always terminate sessions that already exist, and a live session is what the attacker actually wanted.

Then check for changes they may have made to keep access:

• New forwarding rules or filters in your email
• Added recovery email addresses or phone numbers
• New authenticator apps or trusted devices
• Changed security questions

If you entered card details

Call your bank or card issuer now, using the number on the back of the card. Card payments are among the few genuinely reversible ones, and issuers handle this constantly — you will not be the first call today.

Ask them to block the card and issue a replacement. Then watch the account for small test transactions, which often precede larger ones.

If you downloaded or opened a file

Disconnect from the network, run a full scan with your security software, and change important passwords from a different device — if there is a keylogger on the affected machine, changing passwords on it hands over the new ones too.

If it is a work device, contact your IT team immediately rather than trying to resolve it yourself. Speed of disclosure matters more than looking careless, and IT teams greatly prefer an early report to a late one.

If you sent money

Contact your bank immediately — within hours, recall is sometimes possible for transfers. Report to the FTC at ReportFraud.ftc.gov and the FBI at ic3.gov in the US, or Action Fraud in the UK.

Recovery odds depend heavily on method:

Reporting it, even if nothing happened

It takes under a minute and it is genuinely useful. UK: forward to report@phishing.gov.uk. US: ReportFraud.ftc.gov and ic3.gov. Also report inside your mail client, which improves filtering for everyone.

Research cited by the FTC found that only around 4.8% of people who experienced mass-market consumer fraud reported it to a government body or the BBB. Patterns get identified because people bother.

Afterwards

Once things are stable, the changes that stop a repeat are unglamorous and effective: a password manager so nothing is reused, two-factor authentication everywhere, and passkeys wherever they are offered — because a passkey cannot be handed to a fake site at all.