I clicked a phishing link — what to do now

It happens to careful people every day. A message looked real, you tapped the link, and now something feels off. The median person clicks a phishing link in about 21 seconds of receiving it — these messages are engineered to get a reflexive tap. [1] The important thing now is to respond calmly and in the right order.

Step 1: Stop and disconnect if anything downloaded

If clicking started a download or a file opened, disconnect the device from the internet (turn off Wi-Fi or unplug). That limits malware from sending data out or pulling more in. If nothing downloaded and you just landed on a page, you can skip this.

Step 2: Did you actually enter anything?

This is the question that determines everything:

• You only clicked / viewed the page — the risk is much lower. Close the tab. Don’t enter anything. Move to Step 5 to be safe.
• You typed a password, card number, or a one-time code — treat it as compromised and act now (Steps 3–4).

Step 3: Change the password — fast

If you entered a password, change it immediately on the real site (navigate there yourself, don’t use the link). If you reuse that password anywhere else, change it there too — attackers try stolen credentials across many sites. Start with email and banking, since those unlock everything else.

Step 4: Turn on (or check) two-factor authentication

Enable two-factor authentication on the affected account. If you already had it on and were tricked into entering a one-time code, that code may have been used in real time — so changing the password and reviewing active sessions matters. Note that infostealer malware can capture session tokens that sidestep 2FA, which is why a password change plus signing out all sessions is important. [2]

Step 5: Watch for the follow-up

• Review recent account activity and active sign-ins; sign out of all sessions where you can.
• Watch bank and card statements for anything unfamiliar; alert your bank if you entered payment details.
• Expect follow-up scams. Once you’ve interacted, attackers know you’re reachable and may try again by phone or text. Be extra skeptical for a while.

Step 6: Report it

Reporting helps protect others and can get the site taken down. Report phishing pages to Google Safe Browsing and Microsoft (this blocks them in major browsers). In the US, you can also report to the FTC at ReportFraud.ftc.gov and the FBI’s IC3.

How to not be here next time

The reason a click is so risky is that the dangerous page loads before anyone can judge it. A browser-level protection layer changes that: it inspects the page as it loads and blocks a phishing site before you can enter anything — so a moment’s lapse doesn’t become a compromised account.

The takeaway

Clicking isn’t the disaster — entering details is. Disconnect if something downloaded, change passwords if you typed them, turn on two-factor authentication, watch for follow-ups, and report the site. Then add a layer that catches the page next time before it gets the chance.