Cyber for Normies

Accounts and passwords

I clicked a scam link. What do I do now?

By . Published . Last reviewed . Every fact links to its source.

The short answer

Take a breath. What to do depends on what happened after you clicked. If you typed in a password, change it. If you shared a card, bank, or Social Security number, IdentityTheft.gov gives steps for each one (FTC).

If you think something downloaded, update your security software and run a scan (FTC).

Start here: what did you do after you clicked?

I only opened the page

  1. Close the page. Don’t enter anything.
  2. Update your security software, run a scan, and remove anything it flags (FTC).
  3. Report the message and delete it (FTC). For a text, forward it to 7726 (SPAM) (FTC).

I typed in a password

  1. Change that password now, on the real site or app, not from the link.
  2. Change it anywhere else you use the same one (FTC).
  3. Turn on two-factor authentication (FTC, FTC).
  4. If you can’t get into the account, see how to recover a hacked account.

I entered a card or bank number

  1. Call your bank or card company using the number on your card or statement. The Postal Inspection Service says to tell your bank even if you didn’t hit submit (USPIS).
  2. Go to IdentityTheft.gov for steps based on exactly what you shared (FTC).

I shared my Social Security number or birthday

  1. Freeze your credit at all three bureaus. It’s free and doesn’t hurt your score (CFPB).
  2. Get a recovery plan at IdentityTheft.gov (FTC).

Something downloaded, or a pop-up told me to call

  1. Stop logging in to banking, shopping, or other accounts on that device (FTC).
  2. Update your security software and run a scan (FTC).
  3. Change your passwords from a different, clean device and turn on two-factor authentication (FTC).
  4. Never call a number from a pop-up (FTC).

What to do if you already responded and lost money

  • Call your bank or card company first. Ask them to stop or reverse the payment.
  • Report it at ReportFraud.ftc.gov and IC3.gov.
  • Watch for people who say they can get your money back for a fee. The FTC says that’s another scam (FTC).

How to spot the next one

Ask yourself: do I have an account with this company, or know this person? If not, it could be phishing. If you do, contact them using a phone number or website you know is real, not the one in the message (FTC).

Common questions

Can you get hacked just by clicking a link?

It can happen. The FTC says links and attachments in phishing messages might install harmful software, so update your security software and run a scan (FTC).

I clicked but didn’t enter anything. Am I OK?

Probably. Close the page, run a security scan, and report the message (FTC).

Should I change my passwords?

Yes, if you typed one in or think something downloaded. Turn on two-factor authentication too (FTC).

This page is general information, not legal or financial advice. If money already left your account, call your bank or card company first.

Get one plain-English scam warning every Tuesday

Cyber for Normies is a free weekly email for people who don’t work in tech. Short, calm, and easy to forward to the people you look out for.

Join free and get 7 Ways to Spot an Internet Scam, a cheat sheet worth keeping by the phone.
Free. One email every Tuesday. Unsubscribe anytime. Privacy

Sources

  1. IdentityTheft.gov (FTC)
  2. How To Recognize and Avoid Phishing Scams (FTC)
  3. How to Recognize and Report Spam Text Messages (FTC)
  4. Malware: How To Protect Against, Detect, and Remove It (FTC)
  5. Use Two-Factor Authentication To Protect Your Accounts (FTC)
  6. Smishing: Package Tracking Text Scams (U.S. Postal Inspection Service)
  7. What is a credit freeze or security freeze on my credit report? (CFPB)
  8. ReportFraud.ftc.gov (FTC)
  9. Internet Crime Complaint Center (IC3) (FBI)
  10. Refund and Recovery Scams (FTC)