I Clicked a Phishing Link. Now What?

Stop interacting

Close the page or tab. Don't click anything else, don't "cancel" or "unsubscribe," and don't reply to the message. If a pop-up says your computer is infected, ignore it. That's a common scare tactic.

If you downloaded or opened a file, disconnect the device from the internet (turn off Wi-Fi or unplug the network cable) to limit what malware can do.

Change your passwords, from a safe device

If you entered a password on the fake page, change it immediately, along with any other account that uses the same password. Use a different, trusted device if you suspect malware, because a compromised device can capture your new password too.

Prioritize in this order:

1. Email account. It controls password resets for everything else.
2. Banking and financial accounts
3. Password manager (if you use one)
4. Social media and shopping accounts

Make each new password unique and long. A password manager makes this far easier than trying to remember them.

Revoke Active Sessions & Force Sign-Out

Log into your account settings (e.g., Microsoft 365, Google, Apple ID) from a secure device, navigate to the security settings, and select "Sign out of all devices" or "Revoke session tokens". This terminates any unauthorized active sessions created by session-hijacking scripts. Then, check the active login sessions/devices list in your account settings to ensure only your current trusted device remains active.

Check your accounts for damage

For the account you entered details into (especially email accounts):

• Review connected apps and permissions. Remove access for apps or services you don’t recognize.
• Check your sign-in methods. Remove unfamiliar authentication methods.
• Check email forwarding rules and filters. Attackers often create hidden rules to forward or delete messages.
• Check recovery email and phone number. Ideally, these should not be set at all, but if you do, make sure they're still yours. Remember to set up at least a second security key or passkey as recovery method instead of relying on email and SMS.
• Look for messages you didn't send. If your account was used to send scams, warn your contacts.

Scan your device

If you downloaded or opened a file, or your device is acting strangely:

• Run a full scan with reputable antivirus software (Microsoft Defender is built into Windows).
• Look for programs or browser extensions you didn't install and remove them.
• If the scan finds something serious, or you're unsure, a factory reset is the safest option. Back up only your important files first, and scan them before restoring.

Protect your money and identity

If you shared financial or personal information, or sent a payment:

• Call your bank or card issuer immediately. Ask them to block the card, reverse the charge if possible, and flag your account.
• Place a fraud alert or credit freeze with the credit bureaus (in Canada, Equifax and TransUnion; in the U.S., Equifax, Experian, and TransUnion).
• Report it to the authorities. In Canada, contact the Canadian Anti-Fraud Centre. In the U.S., report to the Federal Trade Commission (FTC), as well as with your local police.
• Be alert for follow-up scams. Once you've been targeted, you may be contacted again on same day by "recovery services" or fake bank agents.

Report the phishing attempt

Reporting helps protect others:

• Use the "Report phishing" option in Gmail, Outlook, or through your company's email.
• Notify your company’s IT or security team if the attempt involves a work account or device. Let them know if you clicked a link, opened an attachment, or shared information.
• Report the scam to the relevant bank, organization, or service through its official website or verified contact details.

Keep watching for 30 to 90 days

Stolen information can be used weeks or months later. During this time:

• Review bank and credit card statements regularly.
• Check your credit report for accounts you didn't open.
• Stay cautious about unexpected calls, texts, and emails referencing your accounts.