Clicked a Phishing Link or Gave Your Password? What to Do Now
Step-by-step help after a phishing email: what to do if you clicked a link, typed a password, gave a code or card details, paid a scammer, or let someone control your computer.
It happens to careful people every day. What matters now is acting quickly, in the right order. Find what you did below and follow those steps — they come from the FTC, the UK’s National Cyber Security Centre (NCSC) and the companies whose accounts are affected.
What did you do?
| If you… | Do this first |
|---|---|
| Clicked a link or opened an attachment | Run a full antivirus scan |
| Typed a password on the page | Change that password now, everywhere you used it |
| Gave a verification code or approved a sign-in | Treat it like a stolen password |
| Gave card or bank details | Call your bank or card issuer |
| Paid — gift card, transfer, wire, crypto | Contact whoever handled the payment |
| Let someone control your computer | Update and scan, then change passwords |
| Gave your Social Security number (US) | Go to IdentityTheft.gov |
You clicked a link or opened an attachment
- Run a full scan. The NCSC’s advice: open your antivirus software and run a full scan, then let it clean up any problems it finds.
- Didn’t type anything on the page? Report the email and delete it. If you did type something, carry on with the sections below.
You typed your password
- Change it now — from the company’s own website or app, not the email. The NCSC adds: change it on every other account where you used the same password.
- Turn on two-factor authentication for that account, as the FTC recommends.
- Can’t sign in any more? Use the company’s own account recovery page.
- Check what the attacker may have changed. The big providers list the places to look:
| Account | What the provider says to check |
|---|---|
| Google / Gmail | Review your account activity and select “No, it wasn’t me” for anything you didn’t do; check for devices you don’t recognise; remove labels, filters or forwarding rules you didn’t set up; correct any unfamiliar recovery phone or email; review apps with access to your account. If you can’t sign in, use the account recovery page. |
| Microsoft / Outlook.com | Run a full antivirus scan first, then sign in and change your password (or reset it if you can’t sign in). Then review your settings — connected accounts, forwarding and automatic replies. Microsoft notes it may have reset some of them. |
| Apple Account | Change your Apple Account password immediately and make sure two-factor authentication is on. |
Forwarding rules matter: someone who has been in your mailbox can set one up to keep receiving copies of your email after you change the password.
You gave a verification code or approved a sign-in
A verification code or an approved sign-in prompt is often the last thing standing between a scammer and your account. Apple, for example, says it will never ask for your two-factor code or ask you to tap Accept on a two-factor prompt. Follow the password steps above: change the password, then check the account’s recent activity and signed-in devices for anything you don’t recognise.
You gave card or bank details
- Contact your bank or card issuer straight away — the NCSC’s words — using the number on your card or the bank’s website.
- Cancel the card in your online banking if you can.
- Watch your statements for payments you don’t recognise.
You paid the scammer
The FTC’s advice depends on how you paid. In every case, act immediately and ask for your money back:
| Paid by | Contact |
|---|---|
| Credit card | The card issuer — report it and ask for a refund. |
| Debit card or bank transfer | Your bank or credit union — ask them to reverse the payment. |
| Gift card | The gift card company — tell them a scammer tricked you into giving the card number and PIN. |
| Wire transfer | The wire transfer company — tell them a scammer tricked you into sending money. |
| Cryptocurrency | The exchange or crypto ATM operator — tell them it was a fraudulent transaction. In the US, also report it at ReportFraud.ftc.gov. |
You let someone control your computer
The FTC’s steps: update your security software, run a scan and delete anything it finds, then change your passwords and turn on two-factor authentication.
You gave your Social Security number (US)
If it has been used, report it at IdentityTheft.gov to get a recovery plan. If you’re not sure whether it was used, the FTC points to IdentityTheft.gov/databreach.
If you lost money, report it as a crime
- United States: ReportFraud.ftc.gov.
- United Kingdom: tell your bank, and report it to Report Fraud (England, Wales and Northern Ireland) or Police Scotland, as the NCSC advises.
- Australia: contact your bank or card provider right away, and report to Scamwatch, which can connect you with IDCARE for recovery support.
Afterwards
- Report the email so others are protected — how to report phishing.
- Check the next one before you click: the sender checker and header analyzer tell you whether an email is really from who it says. How to check if an email is real walks through it.
How this guide was checked · October 2026
Verified against 6 official sources
Every step, setting and limit in this guide was checked against the provider’s own documentation on ncsc.gov.uk, consumer.ftc.gov, support.google.com and 3 more. Anything we couldn’t confirm was left out.
- 01 NCSC: Phishing — respond and recover ncsc.gov.uk
- 02 FTC Consumer Advice: What to do if you were scammed consumer.ftc.gov
- 03 Google Account Help: Secure a hacked or compromised Google Account support.google.com
- 04 Microsoft Support: How to recover a hacked or compromised Microsoft account support.microsoft.com
- 05 Apple Support: Recognize and avoid social engineering schemes support.apple.com
- 06 Scamwatch (Australia): Report a scam scamwatch.gov.au
Questions
Frequently asked questions
I clicked a phishing link but didn’t enter anything. What should I do?
Run a full antivirus scan and let it clean up anything it finds, as the NCSC advises. Then report the email and delete it.
I entered my password on a phishing site. What now?
Change it immediately from the real website or app, and on any other account that used the same password. Turn on two-factor authentication, then check the account’s recent activity, devices, forwarding rules and recovery details.
I gave my bank details to a scammer. What should I do?
Contact your bank or card issuer straight away using the number on your card or its website, and cancel the card in online banking if you can.
Can I get my money back after paying a scammer?
Contact whoever handled the payment immediately — your card issuer, bank, gift card company, wire transfer service or crypto exchange — tell them it was a scam and ask for a refund or reversal.
Should I report it to the police?
If you lost money, yes: ReportFraud.ftc.gov in the US; Report Fraud (England, Wales and Northern Ireland) or Police Scotland in the UK; Scamwatch in Australia.
Related guides
Keep reading
Yandex Mail Security
Yandex Mail Security: Yandex Key, App Passwords and Sessions
Protect your Yandex Mail with two-factor authentication, app passwords for email programs, a recovery phone and the log-out-everywhere switch.
3 min read
Mailfence Security
Mailfence Security: 2FA, Service Passwords and Connection History
Lock down a Mailfence account with two-factor authentication and backup codes, service-specific passwords for email programs, and the connections history log.
3 min read
Mail.com Security
mail.com Security: Two-Factor Authentication and a Hacked Account
Set up two-factor authentication on mail.com, keep your secret key safe, and work through mail.com’s steps if your account was hacked.
3 min read
Hushmail Security
Hushmail Security: Two-Step Verification and Safe App Access
Turn on Hushmail two-step verification, keep the backup code, connect email apps with the 20-character security code, and know what encryption does and doesn't cover.
2 min read
Security & Access Security
Fake Apple Account Emails and Texts: How to Tell
How to spot a fake Apple email or text: what Apple says it will never ask for, its warning signs, signs your Apple Account is compromised, and what to do and where to report.
3 min read
Security & Access Security
Fake PayPal Emails: How to Tell, and What to Do
How to spot a fake PayPal email and a fake PayPal invoice or money request: the signs PayPal lists, how to check safely, and what to do if you clicked or paid.
3 min read