What to Do After Clicking a Phishing Link
Realizing that you clicked a phishing link can trigger instant panic. The useful response is not to click around faster. It is to stop, work out what the page could have accessed, and take the actions that match your actual exposure.
Opening a suspicious page is different from entering a password, approving a sign-in, downloading a file, installing software, or giving away payment details. Each step creates a different risk. A link click alone does not prove that an attacker controls your device or accounts, but it is a reason to check carefully.
If this happened on a work device or involved a work account, report it to your IT or security team immediately. Early reporting gives them a better chance to block the site, inspect the device, and protect other people who received the same message.
Stop Interacting With the Page
Close the suspicious page. Do not submit another form, approve a notification, call a number shown on the page, or download a tool that claims it will fix the problem. Fake warning pages often try to turn one click into a larger compromise by persuading you to keep going.
If a file downloaded but you did not open it, leave it unopened. Record its filename and location, then let your security software or IT team handle it. Do not upload a potentially sensitive work file to a random online scanner.
You do not normally need to destroy the device, wipe it immediately, or change every password you own just because a page opened. Those reactions can erase useful evidence and create more work without addressing the real risk. First identify what happened.
Work Out What You Exposed
Reconstruct the interaction while it is fresh. Write down the time, the message that led you there, the device and browser you used, and every action you took after the page opened.
Ask yourself these questions:
- Did the page only load, or did you click anything else?
- Did you type a username, password, authentication code, recovery code, or security answer?
- Did you enter card, bank, tax, identity, or contact information?
- Did you download or open a file?
- Did you install an application, browser extension, configuration profile, or certificate?
- Did you approve a sign-in prompt, connect an account, grant permissions, or allow browser notifications?
Keep the original message until it has been reported, but do not use its links or contact details again. If you are unsure whether it was fraudulent, contact the supposed sender through an app, bookmark, statement, or phone number you already trust. This guide to spotting phishing attacks can help you review the warning signs without returning to the suspicious page.
Secure Any Account Whose Password You Entered
If you typed a password into the page, treat that password as exposed even if the form reported an error. Use a different trusted device when possible, especially if you also opened a file or installed something.
Go directly to the legitimate service through its known app or address. Change the exposed password to a new, unique one. If you reused it anywhere else, change those accounts too. Start with your primary email because access to email can help an attacker reset many other accounts.
After changing the password:
- Sign out other sessions or remove devices you do not recognize.
- Review recent security activity and account changes.
- Check recovery email addresses, phone numbers, and authentication methods.
- Remove unfamiliar connected applications, passkeys, or delegated access.
- Check email forwarding rules, filters, sent messages, and deleted items.
- Turn on multi-factor authentication or replace a method the attacker may have captured.
A password manager makes it easier to replace reused credentials with unique ones. Review this guide to choosing the right password manager if you need a sustainable way to manage them. For important accounts, also review why two-factor authentication matters.
If you entered a one-time code or approved an unexpected sign-in prompt, changing the password may not end an active session. Use the service's security controls to sign out other sessions and revoke access. If you used a recovery code, replace the remaining recovery-code set because some services invalidate or regenerate the entire set together.
Check Downloads, Installations, and Permissions
A page that simply loaded may have been trying to steal information through a form. A file you opened, application you installed, browser extension you added, or configuration profile you approved creates a device-security concern as well.
If you opened a suspicious file or installed something, disconnect the device from Wi-Fi and wired networks when practical. On a work device, stop there and follow your organization's incident process. On a personal device, update its built-in security tools and run a full scan. Remove only items identified through trusted operating-system or security-software guidance.
Do not install a cleanup utility advertised by the suspicious page. Do not assume that deleting the downloaded file reverses an installation that already ran. If the scan finds malware, the device behaves strangely, security tools have been disabled, or you cannot determine what was installed, get qualified help before using that device for passwords or financial activity.
Review browser downloads, extensions, notification permissions, and site permissions. Remove anything you deliberately added during the incident. A systematic browser extension security audit can help you distinguish necessary extensions from unfamiliar access.
Protect Payment and Identity Information
If you entered card or bank details, contact the financial institution using the number on the card, statement, or official app. Explain exactly what was shared and follow its fraud process. Ask whether the card or account credentials should be replaced, then review recent transactions and alerts.
If you disclosed government identity numbers, tax details, passport information, or enough personal data to impersonate you, use the official identity-theft guidance for your country. Consider fraud alerts, a credit freeze, replacement documents, or additional account monitoring where those protections apply.
Do not trust someone who contacts you afterward offering to recover stolen money, remove your details from the internet, or investigate the attacker for an upfront payment. Information from the first scam is often used to make a follow-up approach feel credible.
Watch for Changes After the Incident
Account misuse may happen immediately or days later. Monitor the accounts connected to the information you exposed, with extra attention to email, financial services, mobile carriers, cloud storage, shopping accounts, and social profiles.
Look for unfamiliar sign-ins, password-reset messages, new recovery methods, forwarding rules, purchases, payees, contact changes, or messages sent in your name. Respond through the service's trusted app or address, not through a new alert's embedded link.
Tell close contacts or coworkers if the compromised account sent messages before you recovered it. A short warning can stop the attacker from using your identity to reach the next person.
Report the Phishing Message
Use the mail, messaging, or social platform's built-in phishing report option. If a real company or person was impersonated, notify them through a contact route you independently verify. Workplaces should receive the original message through their normal reporting channel so the security team can search for related attempts.
After reporting, delete the message if your provider or IT team does not need you to retain it. Blocking the sender can reduce noise, but remember that attackers can change addresses and impersonate new organizations. Reporting the content is more useful than relying on a block alone.
A Practical Recovery Checklist
- Close the page and stop interacting with the message.
- Record what you clicked, entered, downloaded, installed, or approved.
- Report work-related incidents immediately.
- Change exposed passwords from a trusted device, starting with email.
- Sign out unfamiliar sessions and review recovery settings and connected access.
- Replace exposed authentication or recovery codes.
- Scan the device if you opened a file or installed something.
- Contact financial or identity services if sensitive information was shared.
- Monitor accounts and warn contacts if your account sent messages.
- Report the phishing attempt through trusted channels.
The Bottom Line
Clicking a phishing link is a warning, not a complete diagnosis. The right response depends on what happened after the page opened.
Stop interacting, document the exposure, and prioritize any account whose credentials you entered. Use a trusted device to change passwords and review sessions. Treat opened downloads, installations, and granted permissions as a device-security issue. If financial or identity information was involved, contact the relevant institution promptly.
A calm, ordered response is faster and safer than trying random fixes. Once the immediate risk is contained, strengthen the accounts and habits that made the incident possible so the next suspicious message has less power.