Clicked a Phishing Link? What to Do Next (Step by Step)

If you clicked a phishing link, close the page and don't type anything into it. If you only opened the email, or clicked and entered nothing, the risk is low: report the email, delete it and keep an eye on your accounts. If you entered a password, go to the real site or app (not the link) and change it, change it anywhere else you used it, turn on two-step verification, and sign out of every other session. If you entered card or bank details, call your bank on the number on your card. If a file downloaded or you opened an attachment, run a full security scan before you change any passwords. Then report the email to your provider and, in the US, to reportphishing@apwg.org and ReportFraud.ftc.gov.

Below we go through it by what happened, then by device (iPhone, Android, Windows and Mac), and show how to check whether someone got into your account. Every step comes from FTC, CISA, NCSC, Microsoft, Google or Apple guidance. For the wider topic, see our guide to email security.

What to do right now

1. Stop. Close the tab or app the link opened. Don't sign in, approve a prompt, install anything or call a number it shows.
2. Work out what you gave away. Did you type a password, a sign-in code, card details or your Social Security number? Did a file download? The answer decides the next steps (see the table below).
3. Scan if anything downloaded. The FTC says to update your security software, run a scan and delete anything it flags. Microsoft says to run a full scan before you change your password, so malware can't capture the new one.
4. Change exposed passwords by typing the site's address yourself or using its official app, never through the email.
5. Call your bank or card issuer if you entered payment details, on the number on your card or statement.
6. Report the email to your email provider and the authorities, then delete it.

On a work device, tell your IT or security team first. Microsoft and the NCSC both put that at the top of their advice, and your company may have its own process.

What to do based on what happened

You only opened the email

Opening a phishing email is rarely enough to cause harm. The danger is in clicking a link, opening an attachment or replying with information. CISA's advice for a suspicious message is to report it with your email app's report button and delete it, without replying or clicking any link, including "unsubscribe".

Opening a message can tell the sender your address is real if the email loads remote images. Gmail says it scans images before you see them and that senders can't use image loading to learn about your computer or location. In other apps, turning off remote content or using an app that blocks trackers keeps that signal from the sender.

You clicked the link but entered nothing

If the page loaded and you closed it without typing anything, you usually just need to report the email and keep an eye on your accounts for a few weeks. A modern, updated browser and phone make it unlikely that simply visiting a page installed anything. The exceptions are a download that started on its own, a prompt you accepted (to install a profile, an app, an extension or allow notifications), or an out-of-date device. If any of those happened, follow the attachment steps below.

Not sure the link was phishing? Don't open it again to check. Go to the company's site or app directly and see whether the message's claims show up there.

You entered a password or a sign-in code

Assume the scammer has the password. Do these in order, today:

1. Change the password on the real site. The FTC says to change it on any other account that uses the same password too. Google adds sites that send email to your Google address or let you sign in with it.
2. Sign out everywhere. If you typed a sign-in code into the fake page, the scammer may already be signed in, and a new password alone doesn't end their session. Google has you review security events and remove unknown devices; Microsoft has a "sign out everywhere" option; Apple has you remove unknown devices at account.apple.com.
3. Turn on two-step verification, or better, a passkey. Google says passkeys can't be shared, copied or accidentally given to someone else, which makes them more secure against phishing. The NCSC also suggests a passkey where one is available.
4. Check recovery details. Make sure the recovery phone and email are yours. Apple also suggests checking with your carrier that nobody turned on SMS forwarding for your number.
5. If it was your email password, check forwarding and filters as well (steps below). A forwarding rule keeps copying your mail to the scammer after you change your password.

You entered card or bank details

Call your bank or card issuer right away, using the number on the back of your card or on a statement, not one from the email. The FTC says to report a credit card payment to the issuer immediately and a debit card payment to your bank or credit union, and to ask for the money back. CISA adds: close any accounts that may have been compromised and watch for charges you can't explain. Set up transaction alerts in your banking app if you don't have them.

In the UK, the NCSC says to tell your bank and, if you lost money, report it as a crime to Report Fraud (England, Wales and Northern Ireland) or Police Scotland on 101.

You gave your Social Security number or other ID details

The FTC sends you to IdentityTheft.gov, which builds a recovery plan from what was exposed. Two free tools also stop new accounts being opened in your name:

• Fraud alert: contact one of Equifax, Experian or TransUnion and it tells the other two. An initial alert lasts one year and can be renewed.
• Credit freeze: you contact all three bureaus. It's free to place and lift, stays on until you lift it and doesn't affect your credit score.

You downloaded a file or opened an attachment

Treat the device as possibly infected. The FTC says to update your security software, run a scan and delete anything it flags. Microsoft says to do this before you change your password. If you can't scan yet, change your important passwords from another device you trust. Don't open the file again, and delete it from your Downloads folder once the scan is done. On a work device, contact IT before deleting anything, since they may want the file.

You replied or called a number in the email

Stop replying. If you shared anything, use the sections above for what you shared. If you let someone connect to your computer remotely, the FTC says to update your security software, run a scan, change your passwords and turn on two-factor authentication.

Clicked a phishing link on your phone

On a phone, the usual harm from a phishing link is a fake sign-in or payment page. Malware is less common, so your password and card steps above matter most. Then do these checks.

iPhone and iPad

• Close the Safari tab and update iOS in Settings > General > Software Update.
• Check for a profile you didn't install. Apple's personal safety guide says to go to Settings > General > VPN & Device Management. If nothing is listed, no profile is installed. To remove one, select it, tap Delete Profile and restart. If the phone belongs to your employer or school, ask them first.
• If you entered your Apple Account details, Apple says to change the password immediately and make sure two-factor authentication is on.
• Forward fake Apple emails to reportphishing@apple.com. For a text, tap Report Junk under the message.

Android

• Close the browser tab and uninstall any app you installed because of the message.
• Check Google Play Protect: open the Play Store, tap your profile icon, then Play Protect > Settings, and make sure "Scan apps with Play Protect" is on. Google says Play Protect is on by default and scans your device periodically.
• If you entered your Google password, follow the Google steps in the email section below.
• Forward phishing texts to 7726 (SPAM), as the FTC recommends, and report them as spam in your messaging app.

Most people don't need to factory-reset a phone after clicking a link. A reset only helps if something was installed that you can't remove. Back up your photos and files first.

Clicked a phishing link on a computer

Windows

Microsoft's steps: open Windows Security, select Virus & threat protection, then Scan options, choose Full scan and start it. Change your passwords after the scan finishes.

Mac

macOS has built-in malware protection called XProtect. Apple says it updates its signatures automatically and, when it finds known malware, blocks it and moves it to the Trash. Delete anything you downloaded from the link, check for unknown configuration profiles, and keep macOS up to date. Apple's path on macOS 13 or later is Apple menu > System Settings > General > Device Management (System Preferences > Profiles on older versions); select a profile you don't recognize, click Remove and restart.

Work or school computer

Tell IT right away, even if you think nothing happened. Microsoft and the NCSC both say to contact your IT team first, and the NCSC says people should feel supported to come forward "even when they have 'clicked'". In Outlook, use Report > Report phishing so the security team gets a copy.

Secure your email account

Your email account resets the passwords for almost everything else, so if you typed its password into a phishing page, check more than the password. The FTC's list for a hacked email account: sign out of all devices, turn on two-factor authentication, confirm your recovery email and phone, look for forwarding rules you didn't create and check your Sent and Deleted folders. Then warn your contacts not to click links from you.

Gmail and Google Account

1. Go to myaccount.google.com > Security & sign-in > Review security events. If you see activity that wasn't you, select No, it wasn't me and follow the steps.
2. Under Your devices, select Manage devices and remove any you don't recognize.
3. Check "Apps with access to your account" and your recovery phone and email.
4. In Gmail, go to Settings > See all settings and check Forwarding and POP/IMAP, Filters and Blocked Addresses, and the accounts tab (who has access to your mail and the address on outgoing mail). Google lists all of these, plus the vacation responder and scheduled emails, as settings a scammer may change.

Outlook.com and Microsoft account

1. Change your password. If you can't sign in, Microsoft's sign-in helper walks you through recovery.
2. Check your account's Recent activity page for sign-ins you don't recognize, and use "sign out everywhere".
3. In Outlook.com, open Settings > Mail > Forwarding and turn off any forwarding you didn't set up. Then open Settings > Mail > Rules and delete any rule you didn't create.
4. Microsoft says that after a hack it resets some account settings, and that you should check connected accounts, forwarding and automatic replies.

A work Microsoft 365 account is your organization's to secure. Report it to IT; they can see sign-ins and rules that you can't.

Apple Account and iCloud

Apple's steps: change your password, review your details at account.apple.com, remove devices you don't recognize under Devices, and confirm you control every email address and phone number on the account. If you can't sign in, start recovery at iforgot.apple.com. Apple suggests security keys for the strongest protection against phishing.

How to tell if you were compromised

A clean scan or an empty Sent folder doesn't prove you're safe, but these signs, taken from FTC, Apple and Google guidance, mean someone probably got in:

• You can't sign in, or your password no longer works.
• Password-change or new-sign-in alerts you didn't trigger, or sign-in codes you didn't request.
• Contacts get strange messages or links from you.
• Sent or deleted emails you don't remember, or new forwarding rules and filters.
• Unknown devices on your account, or recovery details you didn't add.
• Charges or purchases you don't recognize.

If a "security alert" email might itself be fake, don't use its links. Go to myaccount.google.com/notifications (for Google), your Microsoft account's Recent activity page or account.apple.com and check there.

How to report the phishing email

Reporting takes a minute. It trains your provider's filter and helps get the fake site taken down.

• Gmail (computer): open the message, click More next to Reply, then Report phishing.
• Outlook (new Outlook, classic Outlook for Windows, Outlook on the web and Outlook.com): select the message, then on the Home tab choose Report > Report phishing. In Outlook for Mac, use the Message menu > Report > Report Phishing.
• Fake Apple emails: forward to reportphishing@apple.com.
• US: the FTC asks you to forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org (APWG prefers "Forward as attachment" if your app has it) and report the scam at ReportFraud.ftc.gov. Forward phishing texts to 7726.
• UK: forward suspicious emails to report@phishing.gov.uk. If you lost money, report it to Report Fraud or Police Scotland.

APWG notes that some email providers block users from forwarding phishing to it. If the forward bounces, it has a web form for reporting phishing URLs.

How to avoid the next one

Most phishing leans on the same tricks. There's a deadline, the sender address is almost right, and the link goes somewhere other than the text says. CISA warns that good grammar no longer means a message is real, since AI writes clean text. Our phishing email examples show what to look for, and our guide to phishing emails covers the types and how to spot them. The protections that work best after a scare are passkeys or two-step verification on your email, a password manager (it won't fill your password on a fake site) and an email app that flags phishing before you click.

Canary Mail, the email app we make, checks every email for phishing in real time and flags spoofed senders, fake links and impersonation attempts. These checks are part of the Pro+ plan ($100 a year or a one-time lifetime purchase, with a 7-day free trial), and tracker blocking is on by default in every plan. It works with Gmail, Outlook, iCloud and most IMAP accounts. Disclosure: we make Canary Mail. Details are on the Canary security features page, and other options are in our list of secure email apps.

Frequently asked questions

Can I get hacked just by opening a phishing email?

Rarely. Harm usually comes from clicking a link, opening an attachment or replying with information. Opening can confirm your address is active if remote images load, so report and delete the email without clicking anything.

What if I clicked a phishing link but didn't enter any details?

Close the page, report the email and watch for login alerts or odd account activity. If nothing downloaded and you accepted no prompts, you don't need to change passwords, though turning on two-step verification is still worth doing.

Can someone hack my phone if I click a link?

It's uncommon on an updated iPhone or Android phone. The bigger risks are typing your password or card details into the fake page, or being talked into installing an app or profile. Check Settings > General > VPN & Device Management on iPhone and Play Protect on Android.

Should I reset my phone if I clicked on a phishing link?

Usually not. Change any password you entered and remove anything you installed. Consider a reset only if something you can't remove was installed, and back up your files first.

How do I know if I got phished?

Signs include password-change or new-login alerts you didn't trigger, codes you didn't request, contacts receiving messages you didn't send, new forwarding rules, unknown devices on your account and charges you don't recognize.

Should I change all my passwords after clicking a phishing link?

Change the one you entered and any account that uses the same password. If malware may have been installed, scan first, then change your important passwords, starting with email and banking.

Is a credit freeze better than a fraud alert?

A freeze is stronger: it blocks new credit in your name until you lift it, and you set it with all three bureaus. A fraud alert asks lenders to verify your identity, lasts a year and needs only one bureau. Both are free.

Sources

• FTC: How to recognize and avoid phishing scams
• FTC: What to do if you were scammed
• FTC: How to recover your hacked email or social media account
• FTC: What to know about credit freezes and fraud alerts
• FTC: How to recognize and report spam text messages
• CISA: Recognize and report phishing
• CISA: Avoiding social engineering and phishing attacks
• NCSC: What to do if you've shared personal information
• NCSC: Report a scam email
• NCSC: Phishing attacks: defending your organisation
• APWG: Report phishing
• Microsoft: How to recover a hacked or compromised Microsoft account
• Microsoft: Report suspicious messages
• Microsoft: Turn on or off automatic forwarding in Outlook.com
• Microsoft: Use inbox rules in Outlook.com
• Microsoft: How to help keep your Microsoft account safe and secure
• Microsoft Learn: How to protect against phishing attacks
• Google: Secure a hacked or compromised Google Account
• Google: Avoid and report phishing emails
• Google: Choose whether to show images
• Google: Sign in with a passkey
• Google Play: Use Google Play Protect
• Apple: Recognize and avoid phishing messages
• Apple: If you think your Apple Account has been compromised
• Apple: Review and delete configuration profiles
• Apple: Protecting against malware in macOS
• Canary Mail: Pricing

More on encryption, phishing and secure email apps is in our guide to email security.