# I clicked on a phishing link: what to do now

> Clicked a phishing link on a computer? What to do in order: close it, deal with a download, change a typed password, check mail forwarding rules, report it.

- Canonical URL: https://threatvetting.com/i-clicked-a-phishing-link/
- Source: [FTC, how to recognize and avoid phishing scams](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)
- Checked: 2026-10-26
- Structured data: https://threatvetting.com/data/i-clicked-a-phishing-link.json

This page includes a free interactive tool that runs in the browser and sends no data. The figures and rules it uses are the ones stated on this page, with their sources.

## Which page do you need?

| What happened | Go to |
|---|---|
| Clicked on a computer | This page |
| Clicked on an iPhone or iPad | [iPhone steps](https://threatvetting.com/i-clicked-a-phishing-link-on-my-iphone/): Safari, Apple Account, Report Junk |
| Clicked on an Android phone | [Android steps](https://threatvetting.com/i-clicked-a-phishing-link-on-android/): Play Protect, Google Account, Google Messages |
| Paid, or gave card, bank or ID details | [What to do by payment type](https://threatvetting.com/gave-my-details-to-a-scammer/) |

The tool above asks what you did and gives the steps in order; the sections below explain them for a computer.

## 1. Only clicked

Close the tab. If you typed nothing and nothing downloaded, the risk is usually low. Do not go back to the page to "check" it.

## 2. A file downloaded or opened

Do not open it again; delete it. The FTC's advice when you think a link or attachment downloaded harmful software is to update your security software, run a scan and remove anything it flags ([FTC](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)). If you gave someone remote access to the computer, the FTC's steps are the same scan, then deleting what it finds and changing your passwords ([FTC](https://consumer.ftc.gov/articles/what-do-if-you-were-scammed)); doing the password changes from another device is our suggestion.

## 3. You typed a password

Change it now, from the real site reached by typing its address, and on every other account where you used the same password. Turn on two-step verification ([FTC](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)). If it was your email password, also check the account's security page for devices and sign-ins you do not recognise; Google's checklist for a compromised account covers this ([Google](https://support.google.com/accounts/answer/6294825?hl=en)).

## 4. Look for what attackers leave behind in email

Someone who got into your mailbox may set a rule that forwards or deletes mail, so you do not see the password-reset or bank messages that follow. Open your mail settings and look at forwarding and filters; remove anything you did not create. This is our addition from how these attacks work, not a quoted official step.

## 5. Make the account harder to take next time

The FTC lists four protections: security software, automatic updates, multi-factor authentication, and backups ([FTC](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)). A passkey or security key goes further: CISA calls FIDO/WebAuthn sign-in the only widely available phishing-resistant authentication ([CISA](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf)).

## 6. Report it

Forwarding addresses and fraud lines for the UK and US are all on [how to report a scam](https://threatvetting.com/how-to-report-a-scam-email-or-text/). Paste the link into our [link checker](https://threatvetting.com/) first, so you can say which real domain it went to.

---
Threat Vetting · Contact: contact@threatvetting.com