A phishing link is a link in an email, text, or chat message that poses as a trusted company and leads to a fake login page, a payment page, or a malware download.［2］ If you clicked a phishing link, start with the most important point: clicking a phishing link does not automatically mean your account was stolen or your device is infected. The real risk depends on what you did after opening it: whether you entered a password, verification code, card information, downloaded an attachment, or installed a file.［1］［2］

The goal here is not to scare you. It is to help you respond in the right order. What you need now is not regret, but fast containment.

Use the personal privacy guide as the wider checklist: it connects this issue to accounts, devices, identifiers, and data-broker exposure.

Key Takeaways:

Clicking a phishing link does not automatically mean your account was stolen or your device is infected.

The real risk depends on what you did next: entering a password, code, or card details, or downloading and running a file.

Stop interacting, change your email and key account passwords, and check for changes you did not make.

Treat any downloaded file as a possible infection, and contact the payment provider if money or financial data is involved.

First, make a 30-second risk call

Lower risk

You only opened the page;
you did not enter information;
you did not download anything;
you closed it quickly.

This does not necessarily mean you are safe forever, but the next steps are lighter.

Medium risk

You entered an account password;
you entered an email address, phone number, or card fragment;
you filled out a form before a code request.

The priority is to regain account control.

High risk

You downloaded an attachment or installer;
you enabled remote control;
you entered an SMS code, banking details, or identity document;
you kept logging in to other accounts on the same device.

Treat this as both a device-security and identity-security event.［2］［4］

Clicked a phishing link? Do these 6 things immediately

1. Stop the interaction and do not click anything else

Do not go back to see "what else it wants." Do not click buttons like "unsubscribe," "verify again," or "close risk alert."

If the page is still open, close the tab or app. If you already downloaded something, do not run it again.

2. Change the most important account passwords first

A practical priority order is:

Email
Main phone or carrier account
Banking or payment accounts
The account you entered
Any other accounts using the same password

The FTC notes that multi-factor authentication can significantly reduce the chance of account takeover with only a username and password.［1］ After changing passwords, add 2FA immediately.

3. Check for account changes you did not make

Look for:

unfamiliar signed-in devices;
changed recovery email or phone number;
new email forwarding rules;
disabled 2FA;
newly authorized apps or shared members.

Many people change only the password and miss these leftover access paths, which lets an attacker regain the account.

4. If you downloaded anything, treat it as possible device infection

FTC phishing guidance warns that a link in a phishing message can carry malware, and advises updating your security software and then running a scan.［2］ If you downloaded and ran a file:

temporarily disconnect from the network;
run a full scan with a trusted security tool;
check startup items, extensions, and recently installed apps;
avoid logging in to important accounts on that device until you finish checking.

If you think the device may be infected, continue with what to do if your device has a virus.

5. If you shared money or financial information, contact the payment provider

If you provided card details, online-banking information, payment passwords, or verification codes, this is now about financial safety too. The FTC recommends contacting the relevant organizations quickly after a scam or information exposure.［4］

Common actions include:

freezing or replacing the card;
disputing suspicious transactions;
changing payment passwords;
enabling transaction alerts;
asking whether a new card should be issued.

6. Report and then clean up

The FTC recommends forwarding phishing emails to APWG at reportphishing@apwg.org and reporting the attempt at ReportFraud.ftc.gov.［1］ In the US, it also suggests forwarding phishing texts to SPAM (7726).［2］ If identity information is involved, use IdentityTheft.gov to create a recovery record.［4］

Delete the message last, not before you preserve evidence.

What changes by scenario?

You only clicked the link and entered nothing

Focus on:

recording the sender and page domain;
closing browser tabs;
updating your browser;
checking for suspicious extensions;
watching for unusual login alerts over the next few days.

You entered a username and password

Focus on:

changing the password immediately;
signing out of other devices;
enabling 2FA;
checking whether recovery information changed;
finding other accounts that reused the password.

You entered a verification code

This is a higher-risk tier. A code often means the attacker is trying to take over the account in real time. Change the password and review recent logins and security-setting changes.

You downloaded and ran a file

Do not stop at changing passwords. The device itself may now be a new risk source.

Which reactions turn a small problem into a big one?

1. Deleting the message but not changing settings

Deleting the notification does not delete the risk.

2. Changing only the targeted account, not email

Email is the reset path for many accounts, and people often miss it.

3. Logging in to every important account on the same suspicious device

If malware or a malicious extension is present, you may be handing over more credentials.

4. Trusting a "support call" that offers to help

Follow-up scams often impersonate platform support and ask for verification codes, card details, or remote-control access.

What should you watch over the next few days?

Unfamiliar login alerts;
password-reset emails;
payment attempts you did not start;
new browser extensions;
unusual heat, slowdowns, or pop-ups;
friends receiving strange messages from you.

If these appear, the issue may not have stopped at the first click.

Summary

Clicking a phishing link does not automatically mean disaster; the key is whether you entered information, downloaded files, or shared codes afterward.
The first priorities are to stop interaction, change email and key account passwords, and add 2FA.
If you downloaded or ran a file, treat it as a device-infection event.
If money or identity information is involved, contact the payment provider and keep evidence.

FAQ

I clicked a phishing link but did not enter information. Will anything happen?

Not necessarily, but check the device and accounts for anomalies, especially downloads, redirects, or suspicious extensions.［1］［2］

What is the first thing to do after clicking a phishing link?

Stop interacting, close the page, do not click more buttons, and change key account passwords as soon as possible.

Is it enough to change only the account that was phished?

Usually no. Check email and every account that reused the same password.［1］

I downloaded a file but did not open it. Is it still dangerous?

It is lower risk than downloading and running it, but delete the file and run a security scan to confirm it did not execute automatically.

How can I tell whether the link was a phishing link?

Look at the real domain rather than the logo, and be wary of messages that push urgency or ask for a login, payment, or code. Chrome shows a red "Dangerous site" warning for known phishing pages, but new pages may not be flagged yet.［3］ For more signs, read how to spot fake links.

I clicked a phishing link on Android. What should I check?

Open Settings > Apps and remove anything installed around the time of the click, then turn off "Install unknown apps" for your browser and messaging apps. Google Play Protect checks apps on install and periodically scans the device, including apps from outside Google Play, so act on any warning it shows.［5］ If the phone still behaves oddly, follow the steps for a hacked Android phone.

Should I factory reset after phishing?

Not always. Consider deeper cleanup only if you suspect infection, scans cannot confirm the device is clean, or problems continue.

Can a VPN stop me from opening phishing links?

Usually no. A VPN protects your connection, but it does not automatically identify every fake page. Recognition habits, browser warnings, and MFA matter more.［3］

Disclaimer

This article is for general digital-safety education only and does not constitute legal, financial, or forensic advice. Platform and payment-provider risk controls, dispute timelines, and security settings may vary.

A VPN cannot take back credentials entered on a fake site, revoke active sessions, or report the incident for you.

Sources

FTC Consumer Alert, Protect yourself from phishing scams: https://consumer.ftc.gov/consumer-alerts/2025/04/protect-yourself-phishing-scams
FTC Consumer Advice, How To Recognize and Avoid Phishing Scams: https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams
Google Chrome Help, Manage warnings about unsafe sites: https://support.google.com/chrome/answer/99020?hl=en
FTC Consumer Advice, What To Do if You Were Scammed: https://consumer.ftc.gov/articles/what-do-if-you-were-scammed
Google Play Help, Use Google Play Protect to help keep your apps safe & your data private: https://support.google.com/googleplay/answer/2812853?hl=en

Sources checked 4 October 2026.

Related Articles:

Clicked a Phishing Link? Check Exposure and Respond Safely