1. Close the page and stop interacting
Do not continue through warnings, downloads, login prompts or payment forms. If a file downloaded automatically, do not open it until you know what it is.
What to do after clicking a phishing link
2. Identify what information you entered
A click alone is different from submitting a password, card number, one-time code or identity document. Write down what you provided so you can protect the affected accounts.
3. Change compromised credentials from the real service
If you entered a password, open the genuine service independently, change the password and review active sessions. Reused passwords should be changed on other accounts too.
4. Check the device if software was installed
If you installed an app, browser extension, configuration profile or executable from the suspicious page, disconnect if necessary, remove unfamiliar software and run trusted security scans.
5. Contact financial providers when money or card data is involved
If card or banking information was submitted, contact the issuer through its official number and explain that the details may have been captured by a phishing page.
Sources
Primary prevention references
Related
Continue checking
Check suspicious links and sender addresses
Use the same homepage field for a URL or email address.
What to do after clicking a phishing link
- Close the page. Do not continue entering information or approving prompts.
- If you entered a password, change it from the real website or app. If that password was reused elsewhere, change those accounts too.
- Enable multi-factor authentication. Prefer an authenticator app, passkey, or security key when the service supports it.
- Review active sessions and recent account activity. Sign out unknown sessions and revoke suspicious connected apps.
- If you downloaded or opened a file, update security software and run a scan.
- If you entered payment or banking information, contact the financial institution using an official number. Ask about card replacement, transaction monitoring, or account protection.
- If personal identity information was exposed, follow the relevant identity-theft recovery process in your country.
- Preserve evidence and report the phishing attempt. Keep screenshots, sender details, URLs, transaction references, and timestamps where useful.
The action depends on what happened
Only opened the page
Risk is usually lower than if credentials, payment data, permissions, or a downloaded file were involved. Close it and inspect the device/browser for anything unexpected.
Entered a password
Treat the password as compromised. Change it on the legitimate service and review sessions and recovery settings.
Entered card or bank data
Contact the financial institution promptly through a trusted channel and follow its fraud procedures.
Downloaded a file
Do not reopen it. Run current security scans and investigate any unusual device behavior.
Official reference: FTC — What to do if you responded to a phishing email.