First decide what happened

Clicking a suspicious link does not always mean an account has been taken over, but the next steps depend on what followed. Did a page merely open, did you enter a password or code, approve a sign-in, provide payment details, or download and run software? Act promptly and calmly. Use official websites, saved bookmarks or trusted telephone numbers rather than returning through the suspicious message.

Immediate safe actions

  • Close the suspicious page and do not click it again to investigate.
  • If you entered a password, use a different trusted device to visit the provider's official site and change that password.
  • End unfamiliar active sessions and review recovery email addresses, telephone numbers and security alerts.
  • If that password was reused anywhere else, change those accounts to unique passwords as well.
  • If you approved an authentication prompt or shared a code, tell the provider or workplace administrator exactly what happened.
  • If payment details or money may be involved, contact the bank directly using the number on the card or its official website.
  • If software was downloaded or run, disconnect the device from sensitive work and seek technical help before using it for passwords or payments.
  • Keep the original message, sender, time, screenshots and any download name if it is safe to do so.

For a work account or device, follow the organisation's incident-reporting route immediately. Early reporting protects colleagues and customers; hiding a mistake makes investigation harder.

Check for follow-on changes

Look for sign-ins you do not recognise, changed recovery details, new email-forwarding rules, unfamiliar connected applications, sent messages you did not write or bank activity you do not recognise. Continue to treat unexpected authentication prompts as suspicious. Tell affected contacts if the account sent messages to them.

What not to do

Do not reply to or negotiate with the sender. Do not keep testing the link, delete useful evidence or pay someone who contacts you unexpectedly claiming to have found the problem. Never share passwords, authentication codes, recovery codes or remote-control access with an unsolicited caller.

When to stop and ask for urgent help

Get prompt help if you entered credentials or payment information, approved a sign-in, installed software, lost access to an account or see unrecognised transactions. Contact the provider through its official recovery route and the bank directly where relevant. If there is immediate financial loss or crime, follow the bank's and appropriate authorities' reporting guidance.

Prepare for support

Record the time, affected account or device, what the message claimed, each action you took and whether any information was entered. Include exact warning text but do not forward secrets. Say whether the device is personal or business-owned and whether it has been disconnected from sensitive systems.