Clicking is not the same as being compromised. What you did afterwards matters most, so work out which of three situations you are in, then follow the steps for it.
Situation 1: You clicked but did nothing else
Close the page. Do not download anything or enter details. Most pages need you to type something or install something to do harm. Keep your browser and device updated and carry on, but be careful with messages from the same sender. If a download started, do not open it; delete it.
Situation 2: You entered a password or other details
- Change the password now, from the real site or app (not from the link). If you used it anywhere else, change those too. Email first, since it can reset everything else.
- Turn on two-step verification if it is not on. See strong passwords and two-step verification.
- Sign out other sessions. Most services have a "sign out of all devices" option in security settings. This ends sessions an attacker may already hold.
- Check recovery options and forwarding. Make sure the recovery email and phone are yours and that no mail forwarding rule was added.
- Review recent activity in the account for things you did not do.
Situation 3: You entered card or bank details, or shared a code
Call your bank or card issuer using the number on your card or official site. Ask them to block the card or watch the account. If you shared a one-time code, assume that account is open to the sender and secure it immediately. Do not follow instructions from anyone who contacted you first, even if they say they are from the bank.
If you installed something
Disconnect the device from the internet, run your built-in security tool or a reputable scanner, and remove the app. On a phone, uninstall the app and check the permissions of anything recent. If the device handles banking, consider a factory reset after backing up what you can. Change passwords from a different, clean device.
Report it
- Report the message in your email or messaging app. It helps filters.
- Report to your country's cybercrime or consumer protection service if you lost money. In India, the national cybercrime portal (cybercrime.gov.in) and the helpline 1930 handle financial fraud (see our India first-hour checklist); check the rules for your own country.
- Tell the organisation being imitated through its official contact page.
Watch for follow-ups
Scammers often try again, sometimes posing as someone helping you recover your money. Be wary of any new contact about the incident. Check the sender and wording with the scam and phishing detector, and learn the tells in spotting fake login pages.
This guide is general advice, not legal or financial advice. For money already lost, contact your bank first.