WatchmanHQ

Protect · Playbooks · At home

I clicked a link in a scam text or email

Last updated 2026-10-14 · Written with AI assistance, reviewed by a person

Don't panic. A click on its own usually does very little harm, especially on a phone or computer that's up to date. What matters is what happened next: did you type anything, download anything or pay anything? This playbook helps you work that out, then put it right.

Do this now

  1. Close the page. Don't type anything else into it, call a number it shows or follow its instructions. If it won't close, see A scary warning took over my screen.
  2. Think back over what you did after the click. Use the table below. Not sure? Pick the more worrying option. It costs you a few minutes, not a lot.
  3. Typed a password, or tapped Approve on your phone? Change the password now, on the real site. Type the site's address yourself or open its app. Never use the link in the message. Then change it anywhere else you use the same password.
  4. Typed card or bank details? Call your bank or card company on the number on the back of your card.
  5. Keep the message, but don't reply to it. You can report it once you're safe.

What happened after you clicked?

What you didHow urgentWhere to go
Opened the page, then closed it: no sign-in screen, nothing typed, approved or downloadedLow, once you've checked the list in Path APath A
Typed a password or a code, let your browser fill one in, or tapped Approve on a sign-in requestNow: someone may be signing in as youPath B
Typed a card number or bank detailsNowPath C
Typed personal details: Social Security number, date of birth, a photo of your IDTodayPath D
Downloaded or installed something, pasted something in, or let someone control the screenNowPath E
Paid moneyNowI sent money to a scammer

More than one row? Do all of them, starting with the most urgent.

Think it was "only opened"? Check once more. Scam pages very often look like an ordinary Microsoft, Google, Apple or bank sign-in, or a "verify it's you" screen. Because they look routine, they're easy to forget. The list at the top of Path A helps you be sure.

Path A: I only opened the page

First, make sure this really is your path. Go to Path B instead if any of these happened:

Typed something but never pressed the button? It still counts. Fake pages can record what you type as you type it.

Typed only your email address, then stopped? You're probably fine. Expect more scam emails to that address, though.

None of that happened? Then you're very likely fine. Up-to-date phones and computers are very hard to infect just by visiting a page. To be sure:

That's it. If nothing was typed, approved or downloaded, there was nothing to steal.

Path B: I typed a password or a code

Treat the account as if someone else may be in it. Work from a phone or computer you trust.

  1. Change the password on the real site or app. Make it long, and new: never one you've used before. If you can't sign in because the password has already been changed, go straight to Someone got into my email or social media.
  2. Sign out everywhere else. In the account's security settings, look for "Your devices", "Where you're signed in" or "Sign out of all sessions". Remove anything you don't recognize.
  3. Typed a code from a text, an email or an app, or tapped Approve on your phone? Then someone was very likely signing in at that moment. Do steps 1 and 2 right away. Then check the account's recovery email, plus its phone number, are still yours.
  4. Turn on two-step sign-in, ideally with a passkey or an authenticator app. A stolen password alone is then no longer enough.
  5. Was it your email password? Your email can reset nearly every other account, so give it extra care. Follow the checks in Someone got into my email or social media even if everything looks normal.
  6. Used the same password elsewhere? Change it on those accounts too, most important first: email, banking, shopping, social media. A password manager makes this much easier next time.

Path C: I typed card or bank details

Path D: I gave personal details

Your Social Security number, date of birth or a photo of your ID can be used to open accounts in your name. Act today, but there's no need to panic: these steps shut most of it down.

Path E: I downloaded or installed something

Downloaded a file but didn't open it? Delete it, then empty the trash or recycle bin. You're done.

Opened it, installed it, or followed instructions to press some keys and paste something in (a fake "prove you're not a robot" check often asks for this)? Then:

  1. Disconnect from the internet. Turn off Wi-Fi, or unplug the network cable. This cuts off anyone controlling it.
  2. From a different device, change your email password, then your banking passwords. A computer that might be infected can't be trusted to type new ones.
  3. Run a full scan with your security software. On Windows: open Windows Security, choose Virus & threat protection, then Scan options, then Full scan.
  4. Did it install a remote control app, or did someone take over your screen? Follow A scary warning took over my screen.
  5. Still acting strangely? Pop-ups, a new browser home page, programs you don't recognize: get help from a local repair shop you trust, or reset the computer once your photos and files are backed up.

On a phone:

Report it

Reporting takes a minute and helps get the scam taken down for the next person.

Next time

Scam messages are getting very good, so don't feel bad. A few habits beat almost all of them:

Our printable scam sheet puts these on one page, ready for the fridge.

Sources

We checked these on October 14, 2026. If a page has changed, the organization's own advice wins.

Something here wrong or out of date? Email hello@watchmanhq.com.