I Clicked a Phishing Link: What to Do Now

First steps for everyone

This happens to careful people too. What matters now is acting quickly and in the right order:

• Close the page and do not go back to it, even to “check” something.
• Contact companies only through channels you already trust, such as the number on your card or the official app, never through the message.
• Keep the evidence. Do not delete the email or text. Take screenshots of the message and the page address, and note the time and any amounts.
• Do not reply to the scammer or try to negotiate with them.

You only clicked the link

If you opened the page but typed nothing, downloaded nothing and approved nothing, the risk is usually low.

1. Close the tab.
2. Check your downloads folder. If a file arrived, do not open it and follow the steps for a downloaded file below.
3. Make sure your browser and operating system are up to date.
4. Treat the next “urgent” message with extra care: scammers often follow up.

You entered a password

Assume the scammer now has the password and will try it soon.

1. Go to the real service by typing its address yourself or using its official app, and change the password immediately.
2. If you used the same password anywhere else, change it there too, starting with email, which can be used to reset everything else.
3. Sign out of all other sessions and devices, if the service allows it.
4. Turn on two-step verification, preferably with an authenticator app or a security key rather than SMS.
5. Check the recovery email address and phone number, and in your email account look for forwarding rules or filters you did not create.
6. If you are locked out, use the service’s official account recovery.

You entered card or bank details

1. Call your bank now, using the number on your card or on the bank’s official website. Say you entered the details on a fraudulent site.
2. Ask them to block the card and issue a new one, and to check for pending payments.
3. If you entered online banking credentials, change them through the official app or website, or ask the bank to reset them.
4. Go through recent transactions with the bank and dispute anything you did not authorize.
5. Watch your statements closely over the coming weeks.

You shared a one-time code or 2FA code

A one-time code is what lets someone finish a login, approve a payment or move your account to a new device. Treat this as urgent.

1. If the code came from your bank or a payment app, call the bank immediately: the code may have approved a payment or added a new device.
2. For an email, messaging or social media account, change the password, sign out of other sessions and check linked devices.
3. Look for security changes you did not make, such as new recovery details or trusted devices.
4. Legitimate companies never ask you to read out a code they just sent you.

You downloaded or opened a file

1. Disconnect the device from the internet (Wi-Fi and cable).
2. If it is a work device, stop here and call your IT or security team.
3. Do not type passwords on that device until it has been checked.
4. Run a full scan with up-to-date security software. If in doubt, have the device checked or reset.
5. From a different, clean device, change the passwords of your important accounts, starting with email and banking.

You installed an app or gave remote access

Scammers posing as bank staff or technical support often ask you to install a remote access tool, which lets them see your screen and act for you.

1. Disconnect from the internet and end the remote session.
2. Using another phone, call your bank and tell them someone had remote access to your device.
3. Uninstall the app. On Android, also check accessibility settings and device administrator apps for anything you do not recognize.
4. If banking or payment apps are on the same device, consider a full reset before using them again.
5. Change your important passwords from a clean device.

You sent money or made a bank transfer

1. Call your bank immediately and say the payment was made to a fraudster. Ask them to try to stop or recall the transfer and to contact the receiving bank.
2. Give the bank the recipient’s account number or IBAN, the amount, the time and any reference.
3. Report it to the police (see the reporting section below). Banks and payment providers often ask for a police report reference.
4. If you paid by card, ask about a chargeback; if you used a payment app, contact it through the app.
5. Do not send more money, whatever reason you are given.

You connected a crypto wallet or entered a seed phrase

Crypto transfers usually cannot be reversed, so the aim is to protect what is left.

• If you entered your seed phrase (recovery phrase), the wallet is no longer safe. Create a new wallet with a new seed phrase on a clean device and move the remaining funds to it right away.
• If you only connected the wallet or signed a transaction, check which token approvals or permissions you granted using your wallet’s settings or a block explorer, and revoke the ones you do not recognize.
• If funds went to or through an exchange, contact that exchange through its official support channel with the transaction IDs. Exchanges can sometimes freeze funds that arrive on their platform.
• Record wallet addresses, transaction IDs and screenshots, and report to the police.

It was a work account

1. Tell your IT or security team immediately, even if you are not sure anything happened. Early reports help them most.
2. Follow your company’s instructions for reporting the message. Do not delete it, and do not forward it to colleagues.
3. Tell them exactly what you did: what you clicked, what you entered, and when.
4. Do not try to clean the device yourself unless they ask you to.

Report it

Reporting helps get the site blocked and lets the authorities connect cases. More detail is in our guide on how to report a scam.

Türkiye

• Your bank: call the customer service line on your card or on the bank’s official website first if money, cards or banking logins are involved.
• Phishing site: report the address to the Cyber Security Presidency (USOM) at siberguvenlik.gov.tr/ihbar or by email to ihbar@siberguvenlik.gov.tr.
• Police: use the General Directorate of Security’s online report page, or call 112 in an emergency.
• Criminal complaint: if you lost money, file a complaint in person at a police station or the public prosecutor’s office (Cumhuriyet Başsavcılığı), taking your evidence with you.

United States

• Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov.
• Report internet crime to the FBI at ic3.gov, especially if you lost money.
• If your identity was misused, get a recovery plan at IdentityTheft.gov.
• Forward phishing emails to reportphishing@apwg.org and scam texts to 7726.

United Kingdom

• In England, Wales and Northern Ireland, report fraud and cyber crime to Report Fraud, the service that replaced Action Fraud in December 2025. In Scotland, call Police Scotland on 101.
• Forward scam emails to report@phishing.gov.uk and scam texts to 7726 (free of charge). See GOV.UK’s guidance for other types of scam.

European Union

• Report to the police in your country. Europol keeps a list of national online reporting pages; where no online option exists, go to your local police station.
• Contact your bank first if you paid or shared payment details.
• For a purchase from a seller in another EU country, the European Consumer Centres Network can advise you free of charge.

Canada

• Report to the national system run by the RCMP and the Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca, and also tell your local police and your bank.

Report the site to us

If the page impersonated a brand, you can report the site to Phishvoid. Our team checks every report by hand and sends confirmed phishing sites to browser blocklists and CERTs. We cannot recover money, so please follow the steps above as well. If you are unsure what you saw, our guide on how to spot a phishing website can help.

Warning signs of recovery scams

People who have just lost money are targeted again by “recovery” scammers who promise to get it back. Be very careful if someone:

• contacts you first offering to recover your money, often posing as a lawyer, a police unit or an investigator;
• asks for an upfront fee, a “tax”, or a payment to “unlock” or “release” your funds;
• guarantees results, or knows details of your case you never shared with them;
• asks for remote access to your device, your seed phrase or your banking passwords;
• pressures you to act quickly or to keep the conversation secret from your bank or family.

Real police forces and banks do not charge you to recover stolen money. If in doubt, end the conversation and call your bank or the police through an official number.