What should I do if I clicked a phishing link?

The details

Clicking a link alone often does not compromise a fully updated device; the larger risk is what you typed or downloaded afterwards. If you entered a password, assume the attacker has it and act quickly. If you entered card details, call your bank using the number on the back of the card.

Turn on multi-factor authentication for the affected account and review its recent sign-ins, forwarding rules and recovery email or phone number, because attackers often change these to keep access.

What to do

• Change the password from a clean device, and anywhere you reused it.
• Enable multi-factor authentication on that account.
• Check recent activity, recovery details and email forwarding rules.
• Call your bank if you shared payment details.
• Report the message to your email provider and, at work, to your IT or security team.

Useful next reads and tools

• 5 Signs Your Phone May Be Hacked · guide

Terms explained

Multi-factor authentication

Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.

Phishing

Phishing is a fraudulent message, usually email, that impersonates a trusted sender to trick people into revealing credentials, paying money or running malware.

Sources

• FTC: How to Recognize and Avoid Phishing Scams
• CISA: Recognize and Report Phishing