Clicked a Phishing Link? Do This Now

You clicked a link in a message that now looks suspicious. Do not panic, but do not wait either. Work through the steps in this briefing in order. Clean the device first, then change your password from a device you trust.

A phishing link or an attachment might install harmful software. That is why the first moves are to stop using that page and check the device — not to rush straight to a new password while a problem may still be on the device you are using.

Why the scan comes before the password change

Microsoft's recovery guidance for a hacked or compromised account puts a full scan first, before changing or resetting the password. The antivirus software should be up to date, and the scan should be a full scan.

The Federal Trade Commission gives the same starting point for a link or attachment that downloaded harmful software: update your computer's security software, then run a scan, and remove anything it identifies as a problem.

If you change the password first and the device still has harmful software on it, you have skipped the step both guides put first. Do the scan, remove what it flags, and only then move on to the password.

How to stay safe

Turn on multi-factor authentication for your important accounts. The FTC says multi-factor authentication makes it harder for scammers to log in to your accounts if they do get your username and password. It does not make an account impossible to break into, and no step here is a guarantee. It adds a check beyond the password alone.

Use a strong, unique password for each account — a different password for each one. CISA guidance calls for strong, unique passwords on that basis. If you want help creating and storing them, see password managers, explained plainly.

Do not use the contact information or website address in a suspicious message. The FTC says to contact a company using a phone number or website you know is real instead. Type the real address yourself rather than following the link in the message.

To practice spotting a lure before you click, try the Spot the Phish quiz.

If you already did it

Follow these steps in order. Do not skip ahead to the password change.

1. Close the page and disconnect the device. Close the phishing page and disconnect that device from the internet. Do not click, reply, or enter anything else on that page.

2. Update your security software, then run a full scan. Update the security software on the device you used, run a full scan, and remove anything the scan flags as a problem. Do this before you change any password.

3. Move to a device you trust and type the real address yourself. On a separate device you trust, open the real website by typing its address yourself. Never use the link from the message, and do not use contact details from that message either.

4. Change the password — and everywhere you reused it. Change the password for the account involved. Then change it anywhere else you reused that same password. Use a new, strong, unique password for each account — different for each one.

5. Turn on multi-factor authentication. Turn on multi-factor authentication for that account. It makes it harder for a scammer to sign in, even if they got your password.

6. If you entered a card, bank, or Social Security number, act on that too. If a scammer has your Social Security, credit card, or bank account number, go to IdentityTheft.gov. The FTC says you will see the specific steps to take based on the information you lost. Also report the phishing message to the FTC at ReportFraud.ftc.gov.

For the wider cleanup after an account compromise, see account recovery after a compromise.

Keep the limits in mind. A scan removes what it identifies as a problem; neither the FTC nor Microsoft describes it as a guarantee that a device is clean. Multi-factor authentication makes sign-in harder for a scammer who has your password; it is not described as stopping every takeover.

Do step one now. Close that page, disconnect that device, and start the scan before you change a single password.

Sources: FTC — How To Recognize and Avoid Phishing Scams ↗ · Microsoft Support — How to recover a hacked or compromised Microsoft account ↗ · CISA — Four Cybersecurity Essentials for SLTTs ↗ · CISA — Recognize and Report Phishing ↗