Guide

What to do if you clicked on a phishing link

Clicked a link in a phishing email? What to do next, step by step, whether you only opened the page, typed a password, gave bank details or opened a file.

Published · Sources checked · 4 min read

If you clicked a link in a phishing email, what to do depends on what happened next. If you only opened the page, close it and run a security scan. If you typed a password, change it from a device you trust and sign out of every session. If you gave card or bank details, call your bank now.

I clicked the link but didn't enter anything

Close the page. Do not download or open anything it offers. The US Federal Trade Commission's advice for a link that may have downloaded harmful software is to update your security software, run a scan and remove whatever it finds. The UK's National Cyber Security Centre gives the same advice: run a full antivirus scan.

Then report the email, so the next person is warned. The steps for Gmail and Outlook are at the end of this guide.

I entered my password on a phishing site

Assume the password is known. Microsoft's help asks you to run a full antivirus scan before you change it, so that malware on the computer cannot capture the new one. Then work through these steps.

  1. Change the password, and change it everywhere you reused it. The NCSC recommends a passkey where the service offers one.
  2. Sign out of every other session. In a Google Account, review your security events and remove devices you don't recognise. In a Microsoft account, use Sign out everywhere on the security page. Microsoft says it can take up to 24 hours.
  3. Check your mail settings. Intruders add forwarding rules and filters to read your mail after you change the password. Google tells you to check Gmail's filters, forwarding and delegation. Microsoft tells you to check forwarding and automatic replies.
  4. Turn on two-step verification, if it was off.
  5. Tell your contacts. The NCSC suggests it, because a hacked account is often used to send the next phishing email.

I gave my bank or card details

Call your bank or card issuer now, on the number on the back of your card. The FTC says to report it immediately. The FBI's Internet Crime Complaint Center says acting quickly may reduce losses, because the bank can try to recall or reverse a payment.

In the US, a credit freeze stops new credit in your name. The FTC notes that it costs nothing to place or lift and does not affect your credit score. You contact each of the three bureaus: Equifax, Experian and TransUnion. A fraud alert needs only one of them. If you gave out your Social Security number, IdentityTheft.gov lists the steps for each kind of information lost.

I opened an attachment or downloaded a file

Run a full scan with up-to-date security software and remove what it finds, as the FTC and the NCSC advise. If the computer belongs to your employer, call IT before you do anything else.

On a work computer, tell IT now

The NCSC's advice for a work device is to tell your IT department. Report even if you are not sure anything happened. A report in the first hour lets them reset your account, check for forwarding rules and warn colleagues who received the same email. Waiting until you are certain gives the attacker that time instead.

How to report the phishing email

  • Gmail: open the message, select More next to Reply, then Report phishing.
  • Outlook: select the message, then Report, then Report phishing.
  • UK: forward the email to report@phishing.gov.uk. If you lost money, contact your bank and Report Fraud on 0300 123 2040 in England, Wales and Northern Ireland, or Police Scotland on 101. Report Fraud replaced Action Fraud on 4 December 2025.
  • US: report at ReportFraud.ftc.gov, forward the email to reportphishing@apwg.org, and file at ic3.gov if you lost money.

How to spot the next one

Most phishing emails give themselves away in the facts: the sender's real address, where a link really goes, and what the message pushes you to do. The seven checks for Gmail and Outlook take a minute. The attack archive shows how real ones looked.

What Antilure draws before the click

When a link's text differs from where it really goes, Antilure draws a banner inside the email in Gmail or Outlook, before you click, with the line "don't click links or reply" and the real destination in its Details panel. Download Antilure.

Sources

  1. How To Recognize and Avoid Phishing Scams, US Federal Trade Commission, September 2022.
  2. What To Do if You Were Scammed, US Federal Trade Commission, June 2026.
  3. Credit Freezes and Fraud Alerts, US Federal Trade Commission, August 2025.
  4. Phishing scams: If you've shared sensitive information, National Cyber Security Centre, reviewed 5 September 2022.
  5. Recovering a hacked account, National Cyber Security Centre, reviewed 24 August 2022.
  6. Report a scam email, National Cyber Security Centre, reviewed 5 September 2022.
  7. Report Fraud: New service from City of London Police, GOV.UK, 4 December 2025.
  8. Secure a hacked or compromised Google Account, Google Account Help, checked 7 November 2026.
  9. How to recover a hacked or compromised Microsoft account, Microsoft Support, checked 7 November 2026.
  10. How to sign out of your Microsoft account everywhere, Microsoft Support, checked 7 November 2026.
  11. Account Takeover Fraud via Impersonation of Financial Institution Support, FBI Internet Crime Complaint Center, 25 November 2025.