Take a breath — one click is not the disaster it feels like. What you do in the next hour, in the right order, decides almost everything.

It happens in about three seconds. A text about a parcel, an email from your "bank," a message from a friend saying "is this you?" — your thumb taps before your brain catches up, the page loads — and then the cold feeling: that was not real. Take a breath: clicking is only the first move in the scammer's plan, and on its own it does very little. The damage depends on what happened after the page opened — and nearly all of it can still be stopped if you act now, in the right order. This guide is that order — one complete plan, from the first minute to the following month.

First, work out what actually happened

Before anything else, answer one question honestly: what did you do after the page opened? There are three levels, and they need very different responses.

Level 1 — You only opened the page and closed it. You typed nothing, downloaded nothing, allowed nothing. On a device kept up to date, this is usually low risk: browsers and operating systems are built so a web page alone cannot simply help itself to your phone or computer. Attacks needing zero further action exist, but they are rare, costly tools aimed at specific targets, not mass-mailed parcel scams. Do the quick checks — Steps 1, 6 and 8, plus the watch period below — but you can breathe.

Level 2 — You typed information into the page. A password, a one-time code (OTP), card details, your date of birth, anything. Treat whatever you typed as already in the scammer's hands — the page existed to collect it. Serious, but very fixable if you move fast: a stolen password is worth most in the first minutes and hours. Work through the full plan, in order.

Level 3 — You downloaded a file or installed an app. Or you allowed a permission, approved a sign-in prompt, or installed a "security app" or profile the page pushed. Now the device itself is a suspect, not just the account, and Step 6 becomes urgent.

One warning: do not go back to the page "just to look again," and never call a number the page or message shows you. Both are part of the trap.

Step 1: Close the page and cut the connection

Close the tab or the app — completely, not just minimised. If a download started, cancel it and delete the file without opening it; never open a file "to see what it is."

If you are at Level 2 or 3, also disconnect: turn on Airplane Mode, or switch off Wi-Fi and mobile data (on a computer, unplug the network cable). That stops anything nasty from sending data out or pulling instructions in while you work. Stay offline until the device is checked in Step 6.

One thirty-second job first: screenshot the message and the page's address. Scam pages vanish quickly, and you will want the evidence for Step 8.

Step 2: Do not go back to "verify" — expect the second wave

The most dangerous moment is often the hour after the click. Scammers know you are worried now, and worry is their favourite tool. Expect follow-ups: a message saying "your account is locked — log in again to unlock it," a call from "the bank's fraud department" asking you to read out a code, a "tech support" agent who detected your "infected" phone, or a "recovery service" offering to "recover" your money. Every one is the same gang taking a second swing.

The rule: never trust contact that comes to you about this incident. If your bank genuinely needs you, you will find out by opening its app or calling the number on your card. Real banks do not cold-call about "infections," and nobody legitimate charges to recover a victim's money.

Step 3: Change the password — from a clean session, email first

If you typed a password on that page, change it now. Three details decide whether it works:

Use a clean route in. Never follow a link to reach the account — open the service's official app, or type its real address yourself. If anything downloaded onto this device (Level 3), do the changes on a different device you trust: a password typed on a compromised device can be captured as you type it.

Start with your email account. Your inbox is the master key to your digital life: password resets for banking, shopping and social media all land there, so whoever controls it can quietly reset almost everything else. Change it first, then the account the page was imitating, then money apps, then social media.

Fix every place you reused that password. The US Federal Trade Commission's advice to anyone who handed over account details is direct: create a new, strong password for the compromised account, change it anywhere else the same password was used, and turn on two-factor authentication. Scammers test stolen passwords against other services automatically, so using one password for Gmail and Facebook means one click opens both doors. Make each new password long and unique. A password manager helps — and it only offers to fill your login on the real website, so silent autofill on a "bank" page is itself a warning.

Step 4: Turn on two-step verification — and sign out every other session

A new password locks the door, but a thief who is already inside may still hold an open session. So do both halves of this step:

Turn on two-step verification (2SV) or a passkey if it was off. An authenticator app or passkey is stronger than SMS codes, because a code you can be tricked into reading out can be relayed; if SMS is the only option, it still beats a password alone. The NCSC gives the same advice: change reused passwords and use a passkey where available.

Sign out sessions that are not yours. Most major services show where your account is logged in: Google lets you review "Your devices" in your Google Account and remove anything unfamiliar — its compromised-account guidance also tells users to review recent security activity. Facebook shows "Where you're logged in," WhatsApp shows "Linked devices," and most banking and email apps have an equivalent list. Remove every session you cannot identify as your own, and check the recovery email and phone number are still yours — swapping them is how an intruder keeps a way back in.

Step 5: Search the account for damage and back doors

A password change stops new logins; it does not undo changes an intruder already made inside the account. Spend five minutes looking for the quiet tricks:

• Messages you did not send. Check your sent folder and recent chats. Attackers use a stolen account to phish the victim's friends next, often within the hour.
• Forwarding rules and filters. In email especially, look for rules forwarding your mail to a stranger's address, or filters deleting messages from your bank. A hidden forwarding rule means the thief keeps reading your mail — including future reset emails — even after your password change.
• Recovery details. Confirm the recovery email, recovery phone and two-step methods are all ones you recognise.
• Connected apps. Remove third-party apps or websites with access you do not recognise — an "allow access" approval on the fake page can be as powerful as a password.
• Money movements. Check recent transactions, plus new payees or changed transfer limits in banking and wallet apps. Even small unfamiliar amounts matter — report them the same day.

Google's compromised-account checklist covers the same ground: review activity and security events, check signed-in devices, watch for changes to critical settings. If you find anything you did not do, undo it, then repeat Step 4's sign-out.

Step 6: Clean the device

Now deal with the hardware. The FTC's guidance for people who gave a scammer access to a phone or computer is to update your security software, run a scan and delete anything it flags. The NCSC says the same for anyone who opened a suspicious link or installed software: run a full antivirus scan, not just a quick one, and let it clean up what it finds.

• Android: Open the Play Store, tap your profile picture, open Play Protect and run a scan. Look through Settings → Apps for anything you do not remember installing — especially anything from today — and uninstall it. Delete the downloaded file from Downloads, and install waiting system and browser updates.
• iPhone: A normal iPhone cannot be scanned by an antivirus app the way a computer can, and does not need one. Instead: update iOS, delete any app you do not recognise, and check Settings → General → VPN & Device Management for a configuration profile you did not install — a strange profile is a real risk; remove it (leave work or school profiles alone; ask IT about those).
• Windows: Open Windows Security → Virus & threat protection and run a full scan. Remove anything it flags, plus browser extensions you did not deliberately install.
• Mac: Keep the downloaded file closed, scan with a reputable security tool if you have one, update macOS and your browser — and remember a stolen login is an account problem, not a Mac problem: Steps 3–5 still apply.

Ignore pop-ups screaming "YOUR DEVICE IS INFECTED — CALL NOW" or pushing a paid cleaner. That is scareware.

Step 7: Money details? Call the provider right now — before anything else on this list

If you entered card details, bank login details, or a mobile-banking PIN or one-time code, make the call first, then come back to the other steps. Minutes matter.

Call using a number you trust: printed on the back of your card, inside the official app, or on the provider's real website — never a number from the message or the page. Tell them plainly what you entered and when. The provider can freeze or replace the card, flag the account and dispute charges; the FTC's scam guidance has people report card use to the issuer immediately, ask about refunds, and report bank or payment-app transfers at once asking for a reversal.

For mobile money the urgency is even greater, because wallet transfers can be cashed out within minutes. If you entered bKash details, a PIN or an OTP, call bKash's official helpline 16247 straight away; for a different wallet, use the official helpline shown in its genuine app or website. Say plainly if an OTP was involved: a code you typed in can authorise a transaction by itself.

Step 8: Report the phishing, and warn your people

Reporting feels like paperwork, but it is how these pages get taken down and the next victim gets protected:

• In the app where it arrived: use the built-in Report phishing / Report spam / Report junk option, then delete the message. The FTC also asks people to forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and to report the attempt at ReportFraud.ftc.gov.
• To the company being impersonated: most banks and big services run a phishing-report address or page on their official website — forward the message there.
• To your friends and family: if the link could spread through your accounts, warn people now: "My account was compromised — if you get a link or money request from me today, ignore it and call me." A scammer's favourite second target is your contact list.
• At work: if this touched a work phone, laptop or account, tell your IT or security team immediately — before finishing your own clean-up. CISA advises anyone who may have revealed organisational information to report it to the appropriate people in the organisation. IT would rather hear about one click than a company-wide incident next week — and do not delete the message or wipe the device first; they may need the evidence.

If the link came through Messenger, WhatsApp or a text message

Where the link arrived changes a few details:

It opened inside the app. Messenger, WhatsApp, Facebook and Instagram open links in a built-in mini-browser — closing that window is not the same as checking the account. If you typed a login on the page, secure the account in its own app: on Facebook, review "Where you're logged in" and log out strangers; on WhatsApp, check Linked devices and remove unknown sessions.

It came from a friend. Then your friend's account may already be stolen — this is how these links travel. Do not warn them inside the same chat, which the thief may be reading; phone them or use a different app. If your own account was compromised, assume your contacts got the same bait from "you" (Step 8).

It came by SMS. Fake delivery and bank texts are the most common lure on phones. Report the text with your messaging app's report-junk option where available, and do not reply — even "STOP" confirms your number is live. The address bar is hardest to read on a small screen, which is why scammers prefer texts: slow down most when the screen is smallest.

The next 30 days: how long to stay on watch

"Nothing has happened" is good news, but not the end of the story. Stolen details are often tested quickly, then used days or weeks later. Treat the next month as a watch period — calm, but deliberate:

• Today and this week: finish every step above, turn on sign-in alerts in your email, banking and wallet apps, glance daily at transactions, and treat every unexpected call, text or email "about the incident" as a probable follow-up scam (Step 2).
• Weekly for the rest of the month: check statements. Watch for three things: password-reset emails you did not request, sign-in alerts you do not recognise, and small unfamiliar charges. Any of them means someone is testing what they stole — repeat Steps 3–5 and call the provider.
• If a week or two passes quietly, relax to normal attentiveness. If you entered an OTP, a PIN or card details, keep the monthly statement check as a permanent habit — that information does not expire as fast as your worry does.

Make the next click harmless

You cannot promise you will never click again — everyone is busy, tired or distracted sometimes. So make the consequences small:

• Keep everything updated. Phone system, browser and apps. Updates close the holes the rare click-only attacks depend on — that is why "I just opened it" is usually low risk on a patched device.
• Use a password manager and a different password for every account. One stolen password should never open a second door.
• Prefer passkeys and authenticator apps over SMS codes for important accounts; they are bound to the real service in ways a code you can read aloud is not (the passkey guide linked below walks through it).
• Build the pause habit. Any message creating urgency — account closing, prize expiring, parcel returning — is asking you to act before thinking. That feeling is the warning sign. Open the real app yourself and check there; a genuine problem will still exist inside it.
• Report, then delete. Every report trains the filters that protect everyone, including you.

FAQ

Can just clicking a link install malware on my phone or computer?
Rarely, on an up-to-date device. A page by itself normally cannot install anything without you downloading, opening or approving something — which is why the triage above asks what you did after the click. Attacks that need nothing from you exist but are uncommon and usually aimed at specific targets. Keeping everything updated is what keeps "rare" rare.

I typed my email address but not my password. How bad is that?
Not very — an email address alone cannot open your account. But it tells the scammer your address is real and responsive, so expect more targeted attempts: fake reset emails and "security alerts." Make sure that account's real password is strong and unique.

The page looked exactly like my bank. How is that possible?
Because copying a page's appearance is easy. CISA notes that malicious websites may look identical to a legitimate site — the giveaway is the address: a spelling variation or different domain behind the familiar design. That is why every step here starts from an address you type yourself, or the official app.

I entered a one-time code (OTP). Is that as bad as a password?
It can be worse, because in that moment the code was the key — it may have authorised a login or payment immediately. Treat it as an emergency: call the provider (for bKash, 16247), change the password and PIN from a clean session, sign out other sessions, and check transactions the same day.

Should I factory-reset my phone?
Almost certainly not for a click alone. A reset is for confirmed, stubborn malware — say you installed an app from the page and the phone still behaves strangely after uninstalling and scanning. If you only typed information, your accounts are the problem, not the phone; a reset fixes nothing there.

Nothing has happened for a week. Am I safe?
Mostly, if you completed the steps — attackers move fast on fresh passwords and codes, so a quiet week after changing passwords, enabling two-step verification and signing out strangers is a good sign. Keep the light monitoring until a month has passed, especially on accounts where you entered financial details.

The link came from a friend's account. What should I do for them?
Contact them outside that app — a voice call is best — and tell them their account may be compromised and is sending phishing links. Point them to this same plan, and click nothing else they "send" until they confirm by voice that they are back in control.

Sources

• CISA — Avoiding Social Engineering and Phishing Attacks: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks
• US Federal Trade Commission — Protect yourself from phishing scams (Consumer Advice, April 2025): https://consumer.ftc.gov/consumer-alerts/2025/04/protect-yourself-phishing-scams
• US Federal Trade Commission — What To Do if You Were Scammed: https://consumer.ftc.gov/articles/what-do-if-you-were-scammed
• UK National Cyber Security Centre — Phishing scams: if you've shared sensitive information: https://www.ncsc.gov.uk/collection/phishing-scams/what-to-do
• Google Account Help — Secure a hacked or compromised Google Account: https://support.google.com/accounts/answer/6294825

Related reading: AI Phishing in 2026: How to Spot a Fake Email, Message or Voice Call · Passkeys and Two-Factor Authentication: Stronger Sign-Ins in 15 Minutes