What happens if you click on a scam link (toll, USPS, bank texts)?

Take a breath

Scam links are made to look exactly like the real thing, and they fool careful people every day. The FTC says clicking can lead to requests for sensitive data, or can install malware. So the question is not "did I click?" but "what did I do on the page?"

Find your situation

1. I clicked, then closed it without typing anything

   Close the tab and delete the message. Forward the text to 7726 first if you can. USPIS advises telling your bank if you interacted with a fake link "even if you did not click 'submit,'" so a quick call costs nothing. Watch your statements for a few weeks.

2. I typed my card number (toll or USPS "fee")

   Call your card issuer now on the number on the back of the card. Say it was given to a scam site and ask for a new card number. Ask about any charges you don't recognize.

3. I typed my bank login

   Change your online banking password from a device you trust, then call the bank using the number on your statement. Turn on two-step verification. Ask the bank to watch for transfers.

4. I typed a password for email or another account

   Change it right away, and change it anywhere else you used the same one. Turn on two-step verification. The FTC recommends both after any possible compromise.

5. I typed my Social Security number or date of birth

   The FTC says to go to IdentityTheft.gov for steps based on what was exposed. Consider a free credit freeze at Equifax, Experian and TransUnion.

6. I downloaded or installed something

   Stop logging into accounts on that device. The FTC says to update your security software, run a scan, and remove anything it flags. Then change passwords from a different device.

7. I called a number from the page

   Hang up. If you gave remote access or payment, see remote access and getting money back.

Free recovery checklist

Get the step-by-step plan in your inbox

Email addressEmail me the checklist

The printable C.A.L.M. checklist and who to call. No sales pitch. Or open the checklist now (PDF).

What each scam link is after

• Toll texts: The FTC says these scammers "are really after credit card and even Social Security numbers." See toll text scam.
• USPS texts: Fake redelivery fees capture card numbers. USPIS says real USPS tracking texts never contain a link. See USPS package text scam.
• Bank texts: Fake sign-in pages capture your login, or the text gets you to call a fake fraud team who asks you to move money. See bank impersonation scam.
• Account or payment emails: Fake pages ask you to "update" a card or confirm a password. See how to spot a phishing email.

Signs something was installed

The FTC lists signs of malware, including:

• The device slows down, freezes or crashes.
• The browser's home page changes, or you get redirected to sites you didn't choose.
• New toolbars or add-ons appear, or lots of pop-up ads.
• Emails or social media posts go out that you didn't write.

Report it

• Forward scam texts to 7726 (SPAM).
• USPS texts: send the text and a screenshot to [email protected].
• Report the scam at ReportFraud.ftc.gov. If you lost money online, also file at ic3.gov.
• Not sure who to tell first? See where to report a scam.

Next time: check before you tap

If a text or email makes you want to tap fast, that's the moment to stop. Go to the company's app or a website you type yourself. With OwlGuardian, you can say "Hey Siri, call my Owl" to check a text or web page with a screenshot first, and get a verdict in about five seconds.

Questions people ask