If you just clicked a phishing link, stay calm. A single click does not always mean your accounts are compromised, but the next few minutes matter. Do not enter more information, do not download anything else, and work through the steps below in order. This guide is written for people in the UK, with UK reporting routes and practical checks you can do right away.
For help recognising these messages in future, read How to Spot Phishing Emails in 2026: A UK Guide and the Small Business Cybersecurity Checklist UK.
Stop and Do Not Enter Anything Else
Close the suspicious tab or window if you can do so safely. Do not type a password, one-time code, bank detail, or personal information into the page that opened. Do not reply to the message, and do not call a phone number shown on the suspicious page, because scammers often control that number too. If a pop-up claims your device is infected and urges you to call support, close the browser instead of following its instructions.
If you already entered information, note what you entered and when. That list will help you decide which passwords and accounts to change first, and what to tell your bank. Do not try to log in again through the same link.
Close the Tab and Check What Happened
If the link only opened a web page and you entered nothing, your risk is lower, but still take care. Clear the page from your browser, and avoid clicking any further links or buttons on it. If a file started downloading, do not open it. Delete the download if you can find it safely, and run a full scan with your device security software.
Check whether anything unusual has already happened, such as a new login alert, a password reset email you did not request, or a transaction you do not recognise. Keep screenshots of the original message, the sender address, and the link destination if you can do so without clicking again. These details help when you report the attempt.
Change Your Passwords Right Away
If you entered a password, change it immediately, using the official website or app for that service, not a link from the suspicious message. Start with your email account, because email is often used to reset other passwords. Then change passwords for banking, shopping, and social media accounts that use the same or a similar password.
Use a different, strong password for each important account, and turn on two-factor authentication where it is offered. A password manager can create and store unique passwords so you do not have to reuse one password across many sites. If you reused the compromised password anywhere else, change those accounts too, even if they seem unrelated.
If You Entered Bank or Card Details
Contact your bank or card provider straight away using the number on the back of your card or on its official website. Explain that you may have entered details on a phishing site, and ask them to check for unauthorised transactions, block or replace the card if needed, and add extra security to your account. Speed matters here, because banks can often stop or reverse payments more easily if they are told quickly.
Check your statements over the next few days for small or unfamiliar payments, as scammers sometimes test a card with a small charge first. If you see anything you do not recognise, report it to your bank immediately and keep a record of the date, amount, and reference.
If You Downloaded a File
Do not open the file. Delete it, empty your downloads folder if needed, and run a full malware scan on your device. Keep your operating system, browser, and security software up to date, because updates fix security holes that malware can exploit. If your device starts behaving strangely, for example with pop-ups, slow performance, or apps you do not recognise, disconnect from the internet and seek help from a trusted IT professional or your device maker support channel.
If the device is used for work, tell your employer or IT team promptly. Many workplace incidents get worse when people delay reporting because they feel embarrassed, but early reporting is exactly what IT teams want.
Check Your Accounts and Devices
Review recent activity on your email, bank, and main online accounts. Look for new devices, changed recovery email addresses, new forwarding rules, or password changes you did not make. In your email settings, check for rules that forward mail elsewhere, because attackers sometimes set these up to hide their activity. Remove any device or app you do not recognise, and sign out of sessions you do not trust where the service allows it.
Also check your phone for unexpected texts, calls, or app installs. If you entered a code from an authenticator app or text message into a phishing page, treat that account as compromised and change its password and security settings right away.
Report the Phishing Attempt in the UK
Reporting helps protect other people and helps authorities track scams. In the UK, forward suspicious emails to report@phishing.gov.uk, which is run by the National Cyber Security Centre. Forward scam text messages to 7726, which is free on most UK mobile networks. If you lost money or shared sensitive personal information, report it to Action Fraud, the UK national fraud reporting centre, and tell your bank as well.
You can also report the message inside your email app or messaging app, and delete it after reporting. If the scam pretended to be a specific company, such as a bank, delivery firm, or HMRC, you can also report it to that company through its official fraud or phishing contact page. Remember that HMRC, banks, and other genuine organisations will not ask you to share passwords or full card details by email or text.
How to Stop It Happening Again
Slow down before you click. Check the sender address carefully, hover over links to see the real destination where possible, and be suspicious of urgent messages about account closure, unpaid parcels, tax refunds, or security problems. Go to a website by typing its address yourself or using a saved bookmark, rather than following a link in an unexpected message.
Turn on two-factor authentication on email, banking, and social accounts, use unique passwords, keep software updated, and back up important files. Talk through these steps with family members too, because phishing messages often target people who are busy, tired, or worried about a delivery or bill. A short pause and a second check can prevent most phishing attacks.
FAQs
I only clicked the link and entered nothing. Am I safe?
You are in a much better position than someone who entered details, but do not assume all risk is gone. Close the page, do not download anything, run a security scan if anything downloaded, and watch your accounts for unusual activity. If you are unsure, changing the password for any account you were worried about is a sensible precaution.
Should I change all my passwords?
Change the password for the account you entered, plus your email account and any other account that shares the same password. You do not need to change every password you own at once, but prioritise banking, email, shopping, and work accounts, and move to unique passwords over time.
What if I entered my bank details?
Call your bank or card provider immediately using a trusted number, not a number from the phishing message. Ask them to monitor, block, or replace the card if needed, and report any unauthorised transactions. Also report the fraud to Action Fraud if money was taken or your details were used.
How do I report a phishing email in the UK?
Forward the email to report@phishing.gov.uk and forward scam texts to 7726. Report financial loss or identity theft to Action Fraud, and report the message in your email or messaging app as phishing before deleting it.
Can clicking a link infect my phone or computer by itself?
Simply opening a web page rarely infects a modern, updated device by itself, but a page can try to trick you into downloading malware or entering details. That is why you should not open downloads from suspicious pages, keep software updated, and run a scan if anything unexpected downloaded.
The key lesson is simple: act quickly, change the right passwords, contact your bank if money details were involved, report the attempt, and then tighten your security so the next suspicious message is easier to spot and ignore.
