What happened after the click?
Opening a suspicious page is different from entering a password, approving a sign-in, running a downloaded file, or granting remote access. Close the page and avoid interacting with it further while you work out which of those happened.
A click alone doesn’t prove compromise. It also isn’t a reason to ignore an unexpected download, notification permission, or other change.
If you entered a password
Go directly to the real service and change the password. Replace it anywhere else it was reused. Review active sessions, recovery addresses, phone numbers, and authentication methods; a password change may not end every session automatically.
Check your email account
If it may be involved, secure it first because it can recover other accounts. Check forwarding rules, unfamiliar devices, connected applications, and delegated access as well as the password.
If you entered payment details or approved a transaction
Contact the bank or payment provider immediately through its official app or a trusted number. Explain what you entered and what you approved. Don’t wait for visible losses and don’t call a number supplied by the suspicious page.
If you installed software or granted remote access
Disconnect an active suspicious remote session and seek help from a trusted technician or your organization’s IT team. Assess both the device and information accessible during the session. Use a clean device for sensitive recovery if the original may still be compromised.
Updated security scans can help identify malware, but a clean scan doesn’t recover a password you gave away or cancel an authorized malicious transaction.
Preserve and report
Keep the original message and relevant transaction or account notices without revisiting the page. Follow the service’s reporting process. The FTC’s phishing guidance provides U.S. reporting and recovery links.
Watch for follow-up messages and verification prompts. Never share a code or approve a prompt for an action you didn’t initiate. If unsure what you disclosed, prioritize potentially exposed accounts and contact the bank for possible financial exposure.
