I clicked on a phishing link. What do I do?

Find your situation

Clicking is not the same as being hacked. What matters is what happened after the click.

• A) I clicked, saw a page, and closed it. Low risk. Go to step A below.
• B) I typed a password or username. Medium to high risk. Go to step B.
• C) I entered a card number, bank login, or Social Security number. High risk. Go to step C.
• D) Something downloaded, or I installed something. High risk. Go to step D.

A) You clicked but didn't type anything

1. Close the page

   Don't enter anything, and don't click "allow" on any pop-up asking for notifications or permissions.

2. Update and run your security software

   The FTC says to update your security software, run a scan, and remove anything it flags. On Windows, Microsoft Defender is built in: open Windows Security, then Virus & threat protection, then Quick scan. A Mac has built-in malware protection that updates on its own, so keep macOS up to date. For a free second opinion on Windows or Mac, Malwarebytes has a free scanner that finds and removes malware already on the computer.

3. Report the message, then delete it

   In Gmail on a computer, open the message, click More next to Reply, and choose Report phishing. Forward scam texts to 7726.

Free recovery checklist

Get the step-by-step plan in your inbox

Email addressEmail me the checklist

The printable C.A.L.M. checklist and who to call. No sales pitch. Or open the checklist now (PDF).

B) You typed a password

1. Change that password now

   Do it from a phone or computer you trust, by going straight to the real site or app. Not through the link.

2. Change it anywhere you reused it

   Scammers try stolen passwords on other sites. Start with email, then banking.

3. Sign out of other devices and turn on two-step verification

   Most email and bank accounts have a "sign out everywhere" option in security settings.

4. If it was your email password

   Check for forwarding rules or filters you didn't set up. See my parent's email was hacked for the full Gmail checklist.

C) You entered a card, bank login, or Social Security number

1. Card number

   Call the number on the back of the card, cancel it, and get a new one. See I gave a scammer my card number.

2. Bank login

   Call your bank's fraud line now, then change your password. See I gave a scammer my bank account information.

3. Social Security number

   Freeze your credit at all three bureaus today. See I gave a scammer my Social Security number.

D) Something downloaded or installed

The FTC's advice for possible malware: stop logging in to banking and shopping accounts on that device until it's cleaned, update your security software, run a full scan, and then change your passwords from a clean device.

• Warning signs include a slow or crashing device, a changed home page, new toolbars, lots of pop-ups, or emails you didn't write.
• On a phone, delete any app you installed from the link. On Android, run a Play Protect scan from the Play Store.
• If anyone asked you to install a screen-sharing or remote-control app, see a scammer had remote access to my phone or the computer remote access playbook.
• If the scan keeps finding things, get help from a repair shop you find yourself, not one from a pop-up.

If it was your mom or dad who clicked

Adult children often hear about this after the fact, sometimes days later. Start by finding out which of A, B, C, or D happened. Ask calmly. People who feel judged tend to say "I didn't type anything" even when they did.

Report it

• Phishing email: forward to the Anti-Phishing Working Group at [email protected], or use Report phishing in Gmail.
• Phishing text: forward to 7726.
• Then report at ReportFraud.ftc.gov. If anything was stolen, IdentityTheft.gov gives you a recovery plan.

Questions people ask