Which page do you need?

What happened	Go to
Clicked on a computer	This page
Clicked on an iPhone or iPad	iPhone steps: Safari, Apple Account, Report Junk
Clicked on an Android phone	Android steps: Play Protect, Google Account, Google Messages
Paid, or gave card, bank or ID details	What to do by payment type

The tool above asks what you did and gives the steps in order; the sections below explain them for a computer.

1. Only clicked

Close the tab. If you typed nothing and nothing downloaded, the risk is usually low. Do not go back to the page to "check" it.

2. A file downloaded or opened

Do not open it again; delete it. The FTC's advice when you think a link or attachment downloaded harmful software is to update your security software, run a scan and remove anything it flags (FTC). If you gave someone remote access to the computer, the FTC's steps are the same scan, then deleting what it finds and changing your passwords (FTC); doing the password changes from another device is our suggestion.

3. You typed a password

Change it now, from the real site reached by typing its address, and on every other account where you used the same password. Turn on two-step verification (FTC). If it was your email password, also check the account's security page for devices and sign-ins you do not recognise; Google's checklist for a compromised account covers this (Google).

4. Look for what attackers leave behind in email

Someone who got into your mailbox may set a rule that forwards or deletes mail, so you do not see the password-reset or bank messages that follow. Open your mail settings and look at forwarding and filters; remove anything you did not create. This is our addition from how these attacks work, not a quoted official step.

5. Make the account harder to take next time

The FTC lists four protections: security software, automatic updates, multi-factor authentication, and backups (FTC). A passkey or security key goes further: CISA calls FIDO/WebAuthn sign-in the only widely available phishing-resistant authentication (CISA).

6. Report it

Forwarding addresses and fraud lines for the UK and US are all on how to report a scam. Paste the link into our link checker first, so you can say which real domain it went to.