What to Do If You Click a Suspicious Link on Your Phone or Computer

First, determine what actually happened

You receive a message that appears to come from a delivery company, bank, online retailer, or someone you know. You click the link and immediately realize something may be wrong. What should you do?

The answer depends on what happened after you clicked. Opening a suspicious webpage is not the same as entering a password, downloading software, or providing payment information. Those situations involve different risks and require different responses.

If you only opened the webpage

Close the suspicious page. Do not interact with warnings, download prompts, or requests to call a support number. Make sure your browser and operating system are updated. If you did not provide information or install anything, there may be no additional action necessary.

However, a malicious website can sometimes exploit a software vulnerability, so keep your device updated and watch for unusual behavior. Do not assume that every suspicious link automatically installs malware. The appropriate response depends on what the website did and whether you interacted with it.

If you entered your password

Treat the password as potentially compromised. Open the affected service through its official application or by typing its known website address yourself. Change the password. If you reused that password elsewhere, change it on those accounts too. Enable multifactor authentication when available.

Review recent account activity and sign out of unfamiliar sessions if the service provides that option. Do not return to the suspicious webpage to change your password. If you cannot access your account, use the service's official recovery process.

If you provided payment information

Contact your bank or card issuer using the number on your card or its official website. Explain what information you entered. Ask about appropriate protective steps, which may include monitoring transactions or replacing a payment card. Do not use telephone numbers supplied by the suspicious message. If you notice unauthorized transactions, report them promptly through the financial institution's official channels.

If you downloaded or installed software

A downloaded file is not necessarily the same as an installed program. If you downloaded something but did not open it, do not run it. If you installed unfamiliar software, stop using it and investigate. On Windows, open Windows Security and run an appropriate malware scan.

If you granted remote access to someone claiming to provide technical support, disconnect that session and contact a trusted professional or the device's legitimate support provider. Use another trusted device for sensitive account recovery if you suspect the original computer is compromised.

If you entered a verification code

A one-time verification code can sometimes be used to authorize an account login. If you supplied one to a suspicious website or caller, review the affected account immediately. Change credentials where appropriate and contact the service's official support channel if you cannot secure the account.

If the service allows it, review recognized devices and active sessions. Remove access you do not recognize.

What if you gave someone remote access?

This situation deserves particular attention. If someone claiming to be a support technician connected to your computer, they may have been able to view information, change settings, or install software.

End the remote session. If you suspect the computer remains under someone else's control, disconnect it from the internet. Use a different trusted device to secure important accounts. Seek assistance from a reputable professional if you cannot establish whether the computer is safe. Do not allow the same caller to reconnect in order to supposedly reverse the problem.

What should you avoid?

• Do not purchase an unfamiliar antivirus product because a webpage tells you to.
• Do not call numbers displayed in suspicious pop-ups.
• Do not send more personal information to someone claiming they need it to reverse the problem.
• Do not assume that deleting browser history will undo a stolen password.
• Do not pay someone who claims they can guarantee the recovery of stolen information.

How to avoid the same problem

Open important services through saved bookmarks or official applications. Be cautious of messages creating artificial urgency. Use unique passwords and multifactor authentication. Remember that a convincing logo or familiar company name does not establish that a message is legitimate. When in doubt, contact the organization through a number or website you independently know is genuine.

The bottom line: Respond to the actual exposure. A suspicious click calls for caution, while entering credentials, providing payment information, or installing software requires more specific action.

Sources and further reading

• Federal Trade Commission — How to Recognize and Avoid Phishing Scams: https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams
• IdentityTheft.gov — Official identity theft recovery guidance: https://www.identitytheft.gov/