You Clicked a Scam Link: What to Do Right Now

Clicking a bad link does not automatically hand over your money or your accounts, so take a breath first. On a modern phone, simply opening a link rarely does damage on its own. The real danger comes in the next steps: typing a password, entering card details, or installing something the page asks you to install. If you only tapped the link and then closed the page, you are very likely fine.

What matters now is acting in the right order. The steps below run from most urgent to least, so start at the top and work down. Most people who act within an hour avoid any loss at all, so speed helps but panic does not.

First, disconnect and close everything

Close the browser tab or app where the link opened. Do not tap any buttons on the suspicious page, including ones that say Cancel or Close, because on a fake page even those can be traps. Use your phone's own back gesture or the home button instead, then swipe the browser closed.

If the page tried to download a file or asked to install an app, do not open or run it. If something did install, switch your phone to airplane mode for now by opening the control panel (swipe down from the top) and tapping the little aeroplane icon. That cuts the internet while you sort the rest out.

Change the password that was exposed

If you typed a password into the fake page, change that password now, and change it on the real website, not through any link from the message. Open a fresh browser and type the company's address yourself, or use the app you already trust on your phone. The fake page may have copied whatever you entered, so the old password can no longer be considered safe.

If you use that same password anywhere else, change it on those accounts too. Reusing one password across several sites is how a single slip turns into several break-ins. Start with email and banking, because those two unlock the most.

If you entered card or bank details

Phone your bank straight away if you typed a card number, expiry date, or the three-digit code from the back. Use the number printed on the back of your card or on your statement, never a number from the message that sent you the link. Tell them you may have entered details on a fraudulent site and ask them to watch the account or freeze the card.

Banks deal with this every day and can often block a card in seconds and send a new one. Check your recent transactions while you are on the call. If you spot anything you did not make, even a small "test" charge of a dollar or two, report it on the spot, because scammers test with tiny amounts before taking more.

Watch for the follow-up scam

People who fall for one scam often get targeted again within days, sometimes by a caller pretending to be from your bank's "fraud team" offering to help. This second wave can be more convincing than the first, because the caller may already know your name and that something went wrong. A real bank will never ask you to move money to a "safe account" or read out a code.

So if anyone phones or messages offering to fix the problem, hang up and call your bank yourself on the official number. Treat every unexpected message about the incident as suspect until you have confirmed it through a channel you chose.

Clean up the phone or computer

If you installed anything, remove it. On Android, press and hold the new app's icon and choose Uninstall. On an iPhone, press and hold and tap Remove App, then Delete App. On a computer, go to your list of installed programs and uninstall anything you do not recognise that arrived around the same time.

Then restart the device fully by switching it off and on again. If you are still uneasy, ask a trusted family member or a local repair shop to check it over. On a phone, a full reset to factory settings is the strongest cleanup, but back up your photos first and only go that far if a problem persists.

Report it so others are protected

Reporting the scam helps shut the fake site down and warns the next person. In the United States, forward scam texts to 7726 (which spells SPAM) and report fraud to the Federal Trade Commission at reportfraud.ftc.gov. If money was taken, the FBI's Internet Crime Complaint Center at ic3.gov takes those reports.

Do not feel embarrassed. These messages are built by professionals to look real, and they fool careful people every day. Telling family what happened is also worth doing, because the same scam often goes round a whole circle of contacts, and a quick warning can stop someone you love from clicking the next one.

How to spot the next bad link

Scam links nearly always arrive with a sense of urgency attached, because pressure stops you checking. A text saying your parcel is held, your account is locked, or you owe a small fee, all push you to tap before you think. A real company rarely chases you by surprise text with a link, so treat any unexpected one as suspect by default.

Before tapping anything, ask three quick questions. Were you expecting this message? Does the sender's address or number look odd or unfamiliar? Does it pressure you to act in minutes? If the answer to any of those raises a doubt, do not tap the link. Instead, go to the company the way you normally would, by typing its address or opening its app, and check there. That one habit blocks the vast majority of these traps before they ever begin.