Last reviewed: 24 September 2026

I clicked a phishing link. What do I do now?

Don't panic. Clicking alone rarely does damage. What matters is whether you typed anything or opened anything. Pick what happened and work through the checklist. The first 30 minutes matter most.

Money already left your account? Call your bank now on the number printed on your card or in its official app, never a number from the message. In India, also call 1930 straight away. Fast reports are the ones where money gets frozen.

What happened? Pick everything that applies.

Showing every step. Pick what happened to see only the ones you need. Your ticks stay on this device only.

Right now

first 30 minutes

Stop and close the page

Close the tab without typing anything else. Don't reply to the message, and don't call any number it gave you. Scammers often phone right after a click, pretending to be your bank "helping" you.

If you only opened it, you're probably fine

A browser can't normally install anything just because you opened a page. If you typed nothing and nothing downloaded, delete the message and block the sender. Keep going only if something below also happened.

Call your bank and block the card or UPI

Use the number on the back of your card or in your bank's official app. Ask them to block the card, freeze UPI or net banking, and dispute any payment you didn't make. Most banking apps can also freeze a card instantly from the cards menu. If you shared an OTP, say so. It means someone may already be logged in or paying.

Change the password you typed

Go to the real site by typing its address yourself, not through the link, and change the password. If you use the same password anywhere else, change it there too. Start with email, then banking, then everything else.

Sign out every other device and turn on two-step verification

In the account's security settings, choose "sign out of all sessions" or "sign out everywhere". Then turn on two-step verification, preferably with an authenticator app or a passkey rather than SMS.

Disconnect from the internet

Turn off Wi-Fi or mobile data on that device. This cuts off anyone who is controlling it, and stops a malicious file from sending anything out.

Remove the app they asked you to install

Screen-sharing apps like AnyDesk, TeamViewer or QuickSupport are real tools, but scammers use them to watch you type OTPs and PINs. Uninstall anything you installed because a caller or message asked you to. Then treat every password and OTP you typed while it was running as known to them.

Today

within 24 hours

Report it

It helps get payments frozen and fake sites taken down, and you'll need the reference number for your bank. Where to report depends on your country (see the list below).

Run a full antivirus scan

Windows Security, which is built in, or your installed antivirus, set to a full scan rather than a quick one. On a phone, check for apps you don't recognise and remove them.

Check your email for hidden changes

Attackers who get into a mailbox quietly add forwarding rules, filters that delete bank emails, or a new recovery phone number. Check your email settings for forwarding, filters and recovery details, and remove anything you didn't set.

Turn on transaction alerts and check statements

Switch on SMS or app alerts for every transaction, and read the last few days of statements. Scammers often test a card with a tiny payment first.

This week

next 7 days

Change important passwords from a different device

If the device may be infected, change your email and banking passwords from another phone or computer, then again once the device has had a clean scan.

Watch for identity misuse

If you shared ID documents, Aadhaar, PAN, a Social Security number or a date of birth, watch for loans or accounts you didn't open. In the US you can freeze your credit for free with each bureau. In India, lock your Aadhaar biometrics in the mAadhaar app or on uidai.gov.in.

Ignore anyone offering to "recover" your money for a fee

Victims are often targeted a second time by people claiming to be police, lawyers or "recovery agents". No genuine agency charges a fee to return stolen money.

Where to report it

Your country

Lost money? Call 1930, the National Cyber Crime Helpline, or file at cybercrime.gov.in. Call within hours: that is when banks can still freeze the money.
Tell your bank within 3 working days. Under RBI rules, if the fraud was not caused by your own negligence, reporting an unauthorised electronic transaction within three working days means zero liability. If you shared an OTP or PIN, you carry the loss until you report it, so report at once.
Only received the SMS, call or WhatsApp? Report it on Chakshu on the Sanchar Saathi portal. That route is for the message itself; for lost money use 1930.

More detail on India's common scams (e-challan, KYC, electricity bill, parcel, UPI refund): India guide →

Keep evidence. Screenshot the message, the page address, and any payment confirmation before deleting anything. Banks and police will ask for the time, amount and transaction ID.

How to stop it happening again

Never follow a link to log in or pay. Open the app or type the address yourself. Real banks, tax departments and couriers don't ask for card details, PINs or OTPs by SMS.
An OTP is a signature. Anyone asking you to read one out is asking you to approve a payment.
Use a password manager. It won't fill your password on a lookalike site, which catches fakes your eyes miss.
Get a warning before you type. PhishClean checks every page you open for lookalike domains, forms that send your password elsewhere, and fake bill and KYC pages. It runs entirely on your device.

Not sure about a link?

Paste it into our free checker before you open it.

Check a link