Clicked a suspicious link? What to do next

You clicked a link and now something feels wrong. Stop interacting with the page and take stock of what happened. Opening a page, entering a password, and running downloaded software call for different responses.

1. Stop and record what happened

Close the suspicious tab. Do not call a number on it, approve a sign-in request, or install a tool it recommends. Note whether you typed information, downloaded a file, opened it, or allowed someone remote access.

If this involves a work device or work account, contact your IT team promptly through a known channel. Preserve the original message for their investigation without reopening its links.

2. If you only opened the page

A click alone does not prove that an account or device was compromised. Equally, a page that looks harmless is not proof of safety. Check for unexpected downloads and do not open them. Review any permissions you granted, such as website notifications.

If you suspect harmful software was downloaded, update your existing security software and run a scan. The FTC’s phishing guidance recommends this response to a suspected malicious download.

3. If you entered a password or sign-in code

Use the service’s official app or a known website address, preferably on another trusted device if the original device may be compromised. Change the exposed password and any other account using the same one. Treat information typed into a suspicious form as potentially exposed even if you did not press Submit.

Review active sessions, recovery details, and connected apps using the service’s security tools. A password change may not end every existing session. If you shared a verification code or approved a login, use the provider’s account-recovery guidance promptly. Continue with our account security checkup.

4. If you ran software or allowed remote access

Disconnect the affected device from the network to interrupt ongoing remote access. Use a different trusted device for sensitive accounts and get qualified help assessing the affected device. A clean scan is useful evidence, but it is not a guarantee that every problem has been removed.

Follow your security software’s remediation instructions. The FTC’s malware guide explains warning signs and recovery steps.

5. If money or payment details were involved

Contact your bank, card issuer, or payment provider immediately through its official contact method. Describe exactly what was shared or sent and ask about the available protective steps. Do not move money because someone contacting you says it must be “protected.”

6. Report and prepare

Use your email service’s phishing-report option and your local fraud-reporting service where appropriate. Keep useful evidence for the provider handling the incident. For future messages, use our five checks before clicking.