I clicked a suspicious link. Now what?

Don't panic. Opening a bad link on its own rarely does lasting damage. What matters is what happened next, and there's a clear fix for each case.

SafeToHop guide · Updated 13 October 2026 · 5 min read

First: close the page

Close the tab or app without typing anything else. Don't tap buttons on the page, including ones that say "cancel" or "close"; use your browser's own close button instead.

If you only opened the page

On an up-to-date phone or computer, just loading a page is unlikely to infect it. To be safe:

• Install any pending updates for your operating system and browser.
• Don't reply to the message that contained the link. Replying confirms your number or address is active.
• Report and delete the message (see the end of this guide).

If you typed a password

1. Go to the real site yourself, by app or typed address, and change that password straight away.
2. If you use the same password anywhere else, change it there too, starting with email and banking.
3. Turn on two-step verification (a code or app prompt as well as your password).
4. Check the account's recent activity and signed-in devices, and sign out any you don't recognise.

If you entered card or bank details

1. Call your bank using the number on the back of your card, not one from the message.
2. Ask them to block the card and watch for unusual payments. Many banking apps also let you freeze a card instantly.
3. Keep an eye on your statements for the next few months.

If you entered a one-time code

Treat this as urgent. A code lets someone finish signing in as you or approve a payment. Contact the company that sent the code right away and change your password.

If something downloaded

• Delete the file without opening it, and empty your downloads or trash.
• If you opened or installed it, disconnect from the internet and run a full scan with your security software (Microsoft Defender is built into Windows).
• On a phone, uninstall any app you don't recognise. On Android, check which apps have permission to install other apps or use accessibility features.

Report it

Reporting helps get scam sites taken down quickly:

• Email: use your mail app's "Report phishing" or "Report spam" button.
• Text messages: forward the text to 7726 (works in the US and UK).
• US: report fraud at ReportFraud.ftc.gov.
• UK: forward suspicious emails to report@phishing.gov.uk.
• Anywhere: phishing reports can go to the Anti-Phishing Working Group at reportphishing@apwg.org.