Clicked a phishing link on Android? Next steps

Sort yourself into one row

What happened	Risk	Go to
Page opened, nothing typed, nothing downloaded	Lower	Report and move on
Typed a Google password	High	Secure your Google Account
Typed card or bank details	High	Call your bank
An app or file was installed	High	Remove the app

An app or file was installed

If the page got you to install an app or open a downloaded file, check the phone. Google Play Protect checks apps from the Play Store and from other sources, and when it finds a harmful one it warns you, disables it or removes it (Google).

1. Open the Play Store, tap your profile icon, then Play Protect > Settings, and make sure Scan apps with Play Protect is on (Google).
2. If you get a warning, tap it and choose Uninstall.
3. Uninstall anything you do not remember installing today.
4. From another device, change your Google and banking passwords.

Typed your Google password

Google's own checklist for a compromised account (Google):

1. Change the password, and the password of every site that used the same one.
2. Security & sign-in > Review security events. Anything you did not do: "No, it wasn't me".
3. Your devices > Manage devices. Remove what you do not recognise.
4. Gmail settings. Delete forwarding rules, filters and delegation you did not create; turn off IMAP or POP you did not set up.
5. Turn on 2-Step Verification.
6. Check Google Pay and Play for purchases you did not make.

Afterwards, consider a passkey for the account: CISA calls FIDO/WebAuthn the only widely available phishing-resistant sign-in (CISA).

Typed card or bank details

Ring the number printed on your card, not one from the message. The FTC's advice for card payments is to contact the issuer and ask for the charge to be reversed; the law limits your liability for unauthorised use (FTC). For a bank transfer, contact the bank immediately and ask them to reverse it.

Block and report the text

In Google Messages, touch and hold the conversation, then block and report spam; or open it and choose Details > Block & report spam. The number and recent messages go to Google, and the sender is not told (Google). Also forward it to 7726 in the UK or the US: open the message, press and hold, tap the three-dot menu, Forward, and send to 7726 (NCSC, FTC).

Next time

Long-press a link and copy it instead of tapping. Paste it into our link checker: it reads the address as text and shows the real domain without opening anything.

Left out of this page: phones from makers whose own security apps work differently. iPhone steps are on the iPhone page.