It happens in about three seconds. A text says your bank locked your account, your thumb taps before your brain finishes reading, the page loads, something feels wrong, and now there's a cold feeling in your chest. Take a breath. The next ten minutes matter far more than the last ten seconds.
Here is the triage plan, in order.
Minutes 0–2: stop the bleeding.
First, don't type anything. If the page wants a password, a card number, or a code, close the tab. Every field you fill goes straight to the scammer. Second, stop any download that started — cancel it and delete the file. Never open it "to see what it is." Third, disconnect from the internet: airplane mode, or kill Wi-Fi. Fourth, screenshot the page and the original message, including the URL and sender. Scam pages vanish fast and you'll need the evidence for reporting later.
On your phone, the playbook shifts slightly. Close the browser tab, and if the page convinced you to install a profile, configuration file, or app from outside the App Store or Play Store, delete it and restart the phone. Then check what you granted: iPhone users go to Settings → General → VPN & Device Management; Android users check Settings → Apps. Anything unrecognized that appeared today gets removed. Next, install any pending OS and browser updates — the FTC's standing advice after a clicked link is to update security software and run a scan, and on a phone the OS update is the security update. Reconnect, then watch your email, banking, and social accounts for unfamiliar activity over the next few days. Don't ignore login alerts this week.
On a computer, there is one risk phones mostly avoid: real malware that digs in. Run a full antivirus scan with updated definitions — not a quick scan, a full one, and let it finish. Check your browser extensions and remove anything you didn't deliberately install, especially anything added today. Then check the step everyone forgets: your email forwarding rules and filters. If you entered an email password anywhere, the intruder may have set up silent forwarding so they keep receiving your mail — including password-reset emails — even after you change the password. Delete any rule you didn't create. Finally, review signed-in devices and third-party apps on your Google, Apple, or Microsoft account security page and revoke anything unfamiliar.
If you typed anything, treat those credentials as compromised, because they are. Change them in this order: email first — the master key, since password resets for nearly everything flow through it — on the real site, typing the address yourself. Banking and payment apps second, and check recent transactions for anything unauthorized. Everywhere you reused that password third — the American Bankers Association's guidance is blunt: change compromised passwords immediately and don't reuse them anywhere, because attackers automate "credential stuffing" within minutes. Then turn on two-factor authentication on everything that matters; an authenticator app beats SMS codes, and the FTC recommends it as standard protection after any compromise.
If money details were exposed — card numbers, bank logins, or a Social Security number — skip the wait-and-see approach. Call your bank or card issuer immediately using the number on the back of your card. They can freeze the card, issue a replacement, and flag the account for fraud monitoring. If your Social Security number went in, visit IdentityTheft.gov — the FTC's recovery portal — which builds a personal recovery plan around exactly what was exposed. Watch statements daily for the next month: small test charges are how criminals check whether stolen card details work before the big purchase.
Expect a second wave. The phishing link is often just the opening. Once scammers know you're responsive, watch for "tech support" calls claiming your device is infected, fake fraud-department calls asking you to read back a one-time code, and "recovery" scams offering to get your money back for an upfront fee. Real tech companies don't cold-call about infections, and nobody legitimate charges victims upfront. Never trust inbound contact about the incident: if your "bank" calls you, hang up and call the number on your card. Every time.
Reporting takes five minutes and it matters. Forward phishing texts to 7726 (SPAM) and phishing emails to reportphishing@apwg.org. File with the FTC at ReportFraud.ftc.gov, and with the FBI at ic3.gov if you lost money or entered financial details. Report the impersonated company too — most have a phishing-report address findable on their real site.
Clicking feels catastrophic in the moment. It isn't. Stop interacting, disconnect, clean the device, change passwords starting with email, lock down banking if money details were exposed, and report it. The people who get hurt worst aren't the ones who clicked — they're the ones who clicked and then did nothing for a week.
