Clicking a phishing link feels awful, but it is not the end of the story. A click on its own rarely hands over your money or your identity — what matters is what happens in the next hour. Most damage comes from the next steps: entering a password on a fake page, downloading a file, or doing nothing and hoping it goes away. This guide gives you the recovery steps in the right order, explains why the order matters, and tells you what to do if you already typed in your details. Everything here is defensive and legal: you are protecting your own accounts, not attacking anyone else's.
First, stop and do not click further
The moment you realise the link was fake, stop. Do not enter any more information, do not download anything the page offers, and do not click any further buttons, including buttons that claim to "cancel", "verify" or "fix" the problem — on a fake page, every button is the attacker's. If a file has started downloading, cancel it and do not open it. If the page is asking you to allow notifications, close the tab instead of answering. Then close the tab or the app, and do not return to the link to "check" what it was. Curiosity after the first click is how a small mistake becomes a bigger one.
If you are on a phone, also check whether anything was installed. A phishing page sometimes pushes a fake app or a configuration profile. If you see an unfamiliar app, do not open it — uninstall it. If the page asked you to change a phone setting, change it back. Then, before you do anything else, disconnect from the immediate risk: if you were on public Wi-Fi, disconnect from it, and if the page is still open in a browser, close the browser completely.
The first hour: lock the important accounts first
Work in order of importance, not in the order you remember the accounts. Your email account comes first, because email is the master key: with access to your email, an attacker can reset the password of almost everything else. Change your email password from a device you trust, using a password you have never used before, and turn on two-factor authentication immediately if it is not already on — an authenticator app is stronger than SMS codes. Then do the same for your bank and payment apps, then for social media accounts, and then for shopping accounts where a saved card is stored.
Use a different, unique password for each account. Reusing the password you just changed, or a small variation of it, defeats the whole exercise, because the attacker may already have the old one and will try variations. A password manager — even a simple one built into your browser or phone — makes unique passwords practical, and it removes the temptation to reuse the same password everywhere. If you entered the same password on the fake page that you use anywhere else, change it everywhere it is used, starting with the most valuable accounts.
Check sessions, devices and settings
After changing passwords, check who is actually signed in. Most major services — Google, Facebook, Instagram, WhatsApp and banks — have a "devices" or "sessions" page in their security settings that lists every phone, computer and browser currently signed in. Sign out of anything you do not recognise, and sign out of all sessions if you are unsure; signing back in yourself is a small inconvenience, while leaving an attacker's session open is an open door. While you are in the settings, check the recovery details too: the recovery email, recovery phone number and security questions should be yours, not an address the attacker added.
Also check for changes you did not make. Look for new forwarding rules on your email, which can silently send your mail to the attacker; new contacts or payment details in banking and shopping apps; and new posts, messages or friend requests sent from your social accounts. If you find any, remove them and note what they were, because you will need that list when you report the incident. Take screenshots of anything suspicious before you delete it — evidence is much harder to recover after the cleanup.
If you entered card or bank details, act immediately
If you typed card numbers, bank login details or a one-time code into the fake page, contact your bank straight away, using the number on the back of your card or the bank's official app — never a number from the phishing message. Tell them exactly what you entered and when. They can freeze the card, block suspicious transactions and issue a new card, and they deal with this every day, so there is no need to feel embarrassed. Check your recent transactions yourself as well, and keep checking for the next few days, because fraudulent charges do not always appear immediately.
If you sent money, contact the bank and the payment service at once and ask about recall or reversal — the sooner you report, the better the chance, although recovery is never guaranteed. If you entered identity details such as a national ID number or a photo of a document, watch for identity misuse: unexpected accounts, messages or credit applications in your name, and consider the identity-protection steps in our data breach recovery guide. Never pay anyone who contacts you claiming they can "recover" your money for a fee — that is very often a second scam aimed at people who have just been scammed once.
Warn people and report it
If the attacker may have access to your contacts, messages or social accounts, warn the people who could be targeted next. A short message — "my account may have been compromised, please do not click links from me or send money if asked" — protects your friends and family, and it is far less embarrassing than letting them fall for a message sent in your name. Change your profile or cover photo back if it was changed, and delete any posts or messages the attacker sent.
Then report the phishing attempt: to the platform where you received it, to the service being impersonated, and to your country's cybercrime reporting channel. Reporting rarely gets your money back on its own, but it helps take the fake page down, which protects the next person, and it creates a record that can matter for bank disputes. Keep the original message, the link and your screenshots — do not delete them in the cleanup, because investigators and banks may ask for them later.
Scan your device and learn the lesson
Run a full scan with a reputable security app on the device you used, and update the device's operating system and browser to the latest version — updates close the security holes that phishing pages sometimes try to exploit. If you downloaded and opened a file, treat the device as possibly infected: run the scan, remove anything it finds, and if anything still looks wrong, get the device checked by a professional rather than continuing to use it for banking. Do not install "cleaner" or "security" apps from links in messages — get security software only from the official app store.
Finally, make the next phishing attempt fail harmlessly. Turn on two-factor authentication everywhere it is offered, use unique passwords, and adopt one household rule that stops almost every phishing attack: never log in from a link in a message. Always open the app yourself or type the address yourself. If a message claims urgency — an account closure, a parcel problem, a prize — pause, and verify through a separate channel you trust. That single habit, practised until it is automatic, is worth more than any security software.
Frequently asked questions
Is clicking a link enough to get hacked?
Usually not on its own. Most phishing attacks need a second step — entering a password, downloading a file, or granting a permission. That is why the first-hour steps matter so much: they close the door before the second step can do damage.
Should I change all my passwords?
Change the ones that matter most first — email, banking, social media and any account sharing the password you entered — and then work through the rest. Changing everything at once in a panic often leads to reused or weak new passwords, which is worse than a careful, ordered reset.
What if I already entered my password?
Change that password immediately from the real site or app, turn on two-factor authentication, and check sessions and recovery settings. If the same password is used elsewhere, change it there too, starting with the most valuable accounts.
Will the attacker keep coming back?
Possibly — people who have clicked once are sometimes targeted again. Expect more phishing messages for a while, be extra careful with unexpected messages, and keep two-factor authentication on. Each failed attempt after you have locked your accounts down is just noise.
- Stop first: Do not enter more details, download files, or click further buttons on the fake page.
- Email first: Change your email password and turn on two-factor authentication before anything else.
- Work in order: Bank and payment apps next, then social media, then everything sharing the exposed password.
- Check sessions: Sign out unknown devices, check recovery details, and remove email forwarding rules you did not set.
- Money at risk: Call your bank immediately using the number on your card, not from the message.
- Everything here is defensive and legal — securing your own accounts, with no attempt to access anyone else's system.