Threat Vetting

Clicked a phishing link on your iPhone? Do this

Tapped a scam link on an iPhone? What the risk really is, how to clear Safari, secure your Apple Account and bank, and report the text or email to Apple.

2 min — Due for review by 2026-11-25

First: what did you do after the tap?

You only opened the page You typed something You installed or allowed something
Close the tab, clear Safari (below), report the message Go to the matching step below now Treat it as serious: see "Allowed a profile or app"

The FTC's follow-up steps are for two situations: a scammer got a card, bank or Social Security number, or harmful software was installed (FTC). If neither happened, your next moves are tidying up and reporting.

Clear what the page left behind

Settings > Apps > Safari > Clear History and Website Data, choose the time range, then Clear History. This removes your history and the data sites use for tracking, while keeping AutoFill (Apple). You may need to sign in to some sites again afterwards.

Typed your Apple Account password

  1. Change it now in Settings, using a strong password you use nowhere else (Apple).
  2. Check two-factor is on (Apple).
  3. Remove devices you do not recognise at account.apple.com > Devices (Apple).
  4. Check your contact details there, and ask your carrier whether SMS forwarding has been set up on your number (Apple).

Typed another password

Change it from the real app or a site you type yourself, then change it anywhere you reused it, and switch on two-step sign-in. If the account is email, look for new forwarding rules.

Typed card or bank details

Call the number on the back of your card and ask for the card to be stopped. Under US federal law you have protection against unauthorised card use, and the FTC tells you to ask for a refund straight away (FTC).

Allowed a profile or app

If the page talked you into installing something or "trusting" a profile, disconnect from Wi-Fi and mobile data, remove it, and from a different device change your email and bank passwords. Not sure what you allowed? Ask Apple Support or a store before you reconnect.

Report it

  • The text: tap Report Junk under the message in Messages (Apple), and forward it to 7726 in the UK and US (press and hold the message, tap More, select it, tap the arrow, send to 7726) (NCSC, FTC).
  • A message pretending to be Apple: forward the email, or a screenshot of the text, to reportphishing@apple.com (Apple).
  • Lost money or data: see the reporting table on I clicked a phishing link.

Next time: preview before you tap

Touch and hold a link to see its real address before it opens (Apple). Copy it and paste it into our link checker to see the true domain and the tricks it uses, without visiting the page.

Left out of this page: Lockdown Mode and spyware cases. If you think you are being targeted personally, talk to Apple Support directly.