I Clicked on a Phishing Link: What to Do Now

By Chris Clark, founder of Senior Tech Cafe

If you clicked on a phishing link, start here. A single click rarely empties a bank account or takes over a computer, and what you do in the next few minutes matters far more than the click itself.

It usually starts innocently. You’re checking your email to see if your grandson finally wrote back (he didn’t), and there’s a message: “URGENT: Your package from The Intergalactic Mail Service cannot be delivered!” You didn’t order anything, but maybe it’s a surprise. So you click. A weird box pops up, the computer starts whirring like it’s preparing for a mission to Mars, and your stomach drops into your slippers. You’ve clicked on a suspicious link, and clearly you just gave the deed to your house to a hacker named DarkLord99.

You didn’t. Scammers rely more on your panic than on their computer skills. Here’s what to do first, in order.

What to Do Right After You Click a Phishing Link

Take these steps in order. If all you did was click and close the page, steps 1, 3 and 7 are all you need.

1. Don’t type anything. If the link opened a page asking for a password, your Social Security number or card details, close it without entering a single letter. Without those details, the people behind it usually can’t get in.
2. Disconnect if something downloaded or a stranger got in. If a file downloaded, a pop-up won’t go away, or you let someone connect to your computer, turn off Wi-Fi, unplug the network cable, or put your phone or tablet in Airplane Mode. Don’t call any phone number a pop-up gives you.
3. Run a security scan. The Federal Trade Commission’s advice is to update your security software, run a scan and remove anything it flags. The steps for computers and phones are below.
4. If you typed a password, change it now, from a different device you trust, and anywhere else you use the same password. Turn on two-factor authentication while you’re there. If you’re already locked out, follow our hacked account recovery guide.
5. If you typed bank or card details, call your bank. Use the number on the back of your card, not one from the message. Our guide on what to do if you gave a scammer your bank details covers the rest.
6. If you typed your Social Security number, go to IdentityTheft.gov. It’s the FTC’s recovery site, and it builds a step-by-step plan based on what you shared.
7. Report the message. Forward phishing emails to reportphishing@apwg.org and texts to 7726 (SPAM), then delete them. You can also report the scam at ReportFraud.ftc.gov.

What Happens If You Click on a Phishing Link?

Usually, clicking a phishing link just opens a web page. The danger comes from what that page wants you to do next, and it’s normally one of three things:

• A fake login page. The most common kind. It looks like your bank, your email or a delivery company and waits for you to type a password or card number. If you didn’t type anything, it got nothing.
• A download. Some links try to get you to open a file dressed up as an invoice, a shipping label or a software update. The file is the problem, not the click.
• A scary pop-up. The page shouts that your computer is infected and gives you a phone number to call. The pop-up is harmless. The person who answers that number is not.

A lot of folks think that the moment they click a bad link, a hacker is watching through the webcam while emptying their bank accounts. That’s not how it usually works. Now and then a flaw in an out-of-date browser lets a page do more, which is one more reason to keep your phone and computer updated. And even a harmless click tells the sender your address works, so expect a little more junk for a while.

The Visual Symptom Decoder: What’s Actually Happening?

Once you’ve disconnected, your computer might start throwing error messages at you. These messages are written by computer programmers, which means they’re completely incomprehensible to normal humans. Here’s a translation.

Windows Security says protection is off. If you see a warning that virus and threat protection is turned off and you didn’t turn it off, treat it as a red flag. It doesn’t mean your computer is destroyed. It means your frontline security guard may have been knocked out, and it’s time to call in the backup, which is the scan below.

Updates are paused. If Windows says updates are paused and you didn’t pause them, that’s another warning sign. Updates often contain the fix for whatever a piece of malware is trying to exploit, so malware has every reason to stop them.

Drive-By Downloads: Files You Didn’t Ask For

What if you didn’t click “download,” but a file appeared on your computer anyway? That’s called a drive-by download. It’s the internet equivalent of someone tossing a flyer through your car window while you’re stopped at a red light. Just because the flyer is in your car doesn’t mean you have to read it. A downloaded file usually can’t hurt you until you open it, so don’t. Delete it and run the scan below.

Sometimes your computer is doing its job and it still looks terrifying. If Windows Security or your antivirus says it blocked or removed a file, that’s your computer’s immune system at work, not a sign you’ve been hacked. Run the full scan anyway, just to be sure.

Digital Cleaning: How to Scan Your Computer or Phone

On a Windows computer, run a Microsoft Defender offline scan. It works with the internet still off. It restarts your computer and looks for malware before Windows loads, when it has the hardest time hiding. Save anything you have open first.

1. Type Windows Security into the Start menu search and open it.
2. Click Virus & threat protection, then Scan options.
3. Choose Microsoft Defender Antivirus (offline scan) and click Scan now.

When it’s done, the computer restarts on its own. To see what it found, open Windows Security again and look under Protection history. Once you’re back online, a second scan with the free version of Malwarebytes is a good double-check.

On a Mac, built-in protection checks for known malware automatically. Install any waiting macOS update and delete anything you downloaded from the link.

On an Android phone, open the Play Store, tap your profile picture, tap Play Protect, then tap Scan.

On an iPhone or iPad, a click alone almost never installs anything. Close the tab, then clear your browsing data: in Settings, open Safari (on newer iPhones it’s under Apps) and tap Clear History and Website Data. Then install any waiting software update.

Recovery, Prevention, and Staying Alert

Once your scans come back clean, the emergency is over. For the next few weeks, keep an eye on your bank and card statements, and be extra suspicious of follow-up messages, especially any that offer to help you recover from the scam you just dodged.

Going forward, practice the fine art of hovering. Rest your mouse pointer over a link without clicking, and a little box near the bottom of your screen shows where it really goes. On a phone, press and hold the link instead of tapping it. If the address doesn’t match the company, you’ve caught one. Our guide to spotting phishing scams covers the other giveaways.

Questions About Clicking a Phishing Link

Did I Break My Computer by Clicking a Phishing Link?

Almost certainly not. Clicking a phishing link doesn’t damage the computer itself. Unless you opened a file from the link or let someone control your screen, the worst case is usually unwanted software that a security scan can remove. Run the scan, install any waiting updates, and carry on with your day.

Can Scammers See Me Through My Camera After One Click?

Very unlikely. Getting into a webcam takes more than one click on a web page; it usually needs malware you opened or remote access you allowed. If you’re nervous, a sticky note over the lens is a foolproof, zero-tech fix, and a security scan will catch most spying software.

Is My Bank Account Empty Because I Clicked a Link?

No. Scammers can’t pull money out of your bank account just because you clicked a link. They need your username, password, card number or a one-time code. If you didn’t type any of those into the page, your money is safe. If you did, call your bank using the number on your card.

How Did Scammers Get My Email Address in the First Place?

Email addresses are like phone numbers: eventually, everyone ends up on a list somewhere. It rarely means you were singled out or hacked. More often, your address was part of a huge automated blast sent to millions of people in the hope that a few would click.

What If I Clicked on a Suspicious Link on My Phone?

If you clicked on a suspicious link on a phone, it usually just opened a web page, and phones rarely install anything without asking first. The risk is typing a password or card number into that page, or installing an app it offers. Close the tab, don’t install anything, and change any password you entered.

The Bottom Line on Phishing Links

Clicking a bad link feels like a disaster. Most of the time it’s a scare, not a catastrophe, and the steps above turn it back into an ordinary Tuesday: don’t type, disconnect if something downloaded, scan, change anything you gave away, and report the message.

Keep your software updated, keep hovering before you click, and keep your sense of humor handy. DarkLord99 is counting on you to panic. For more ways to stay a step ahead, start with our online safety guide for seniors.