I Clicked a Phishing Link: What to Do Now
Clicked a phishing link by mistake? A calm, step-by-step fix: disconnect the device, scan for malware, change passwords from a clean phone, and report it.
Clicking a phishing link is usually recoverable, especially if you didn’t type anything or download a file. Move fast on three fronts: disconnect from the internet, scan the device for malware, and change the passwords for any account the page mentioned — ideally from a second device you trust. Work the list in order.
First, cut the connection
Don’t type anything into the page, and don’t “log in to check.” Close the tab and disconnect: turn off Wi-Fi, unplug the ethernet cable, or switch a phone to airplane mode. That stops any file that slipped through from reaching the attacker or pulling down more. Treat the device as untrusted until it’s scanned.
Scan for malware
On Windows, the built-in Microsoft Defender handles this. Open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan, and select Scan now. That option restarts your PC and scans before Windows loads, catching malware a normal scan misses. If it won’t run, start it in Safe Mode first. On Android, uninstall any app you were prompted to sideload, then run Play Protect.
Change passwords from a clean device
If the page asked for a login, assume that password is burned. Change it from a phone or computer you didn’t click on — start with your email, since it resets everything else, then banking and any site that reused the password. Turn on two-step verification wherever it’s offered. A good password manager makes unique logins painless, and it’s the moment to build stronger ones.
If you entered real details, report it
Typed a Social Security or card number? The FTC’s IdentityTheft.gov builds a recovery plan for what you lost, and your bank can flag the card. Then report the message itself:
| What you received | Where to send it |
|---|---|
| Phishing email | Forward to [email protected] |
| Phishing text | Forward to 7726 (SPAM) |
| Any scam attempt | Report at ReportFraud.ftc.gov |
Most “I clicked it” moments end with a clean scan and a couple of fresh passwords. Watch your bank and email for unfamiliar logins over the next few weeks, and if something looks off, change that password again from a safe device.