If you clicked a suspicious link, entered information on a fake page, downloaded a file, or shared payment details, act quickly but methodically. This phishing recovery plan helps you contain the incident, secure affected accounts and devices, notify the right people, preserve evidence, and monitor for follow-up harm.
Overview
A phishing incident can range from a harmless click to a serious account or identity compromise. The correct response depends on what happened, but the safest approach is to assume that any information entered into the suspicious page may be exposed.
Start with containment rather than investigating the message in detail. Stop interacting with the email, text, QR code, website, or caller. Do not reply, click again, or use contact information supplied in the message. Open the legitimate service through a known app, a saved bookmark, or an address you type yourself.
Your first priorities are:
- Secure accounts whose passwords or codes may have been exposed.
- Stop unauthorized sessions and devices from remaining signed in.
- Protect money, payment cards, and identity documents.
- Check devices for suspicious software or changes.
- Record what happened so you can explain it accurately to providers, financial institutions, an employer, or an identity-monitoring service.
If you entered a password, treat it as compromised even if nothing unusual has happened yet. If you only opened a page and entered nothing, the response may be simpler, but device and account checks are still sensible. A phishing scam warning is useful only when it leads to a concrete recovery step.
What to track
1. The information you shared
Write down whether you provided a password, one-time code, recovery code, security-question answer, phone number, address, date of birth, payment-card details, bank information, tax or identity-document details, or a photo of an identification document. Note whether you uploaded a file or installed an application. This list determines which accounts and organizations need attention first.
Do not put this record in the same compromised email account or in an unprotected note synchronized to an affected device. Use a trusted device when possible, and avoid recording complete payment or identity numbers unless a secure support process specifically requires them.
2. Accounts and sessions
Change the password for the affected account from its official website or app. If you reused that password anywhere else, change those accounts too, beginning with email, financial services, cloud storage, social networks, and password-manager access. Use unique passwords; a password manager can make this manageable. See the Password Manager Safety guide for selection and setup considerations.
After changing a password, use the account's security settings to sign out of other sessions, remove unfamiliar devices, review connected applications, and check recent login activity. Changing a password alone may not end an existing session. Update recovery email addresses and phone numbers if they were altered, and confirm that forwarding rules or filters were not added to an email account.
3. Authentication and recovery controls
Turn on multifactor authentication where it is available, preferably with an authenticator app or a hardware security key when appropriate for the account. SMS-based codes may still be useful, but they should not be treated as a substitute for every other account control. Review the account's backup codes and store new codes securely if you believe old ones were exposed. For a comparison of common options, read Authenticator App vs. SMS Codes.
4. Money and identity exposure
If you shared bank, card, payment-wallet, or money-transfer information, contact the institution through its official app, website, or a verified phone number. Explain what was shared and ask what protective steps are available. Review transactions and alerts closely rather than waiting for a charge to appear.
If identity information was exposed, consider a credit freeze or other monitoring options available in your jurisdiction. A freeze can help limit certain new-credit applications, but it does not replace reviewing existing accounts or watching for impersonation. Use the credit-freeze and identity-monitoring checklist as a separate follow-up plan.
5. Devices and evidence
If you downloaded a file, installed an app, granted remote access, or entered information on a device you do not fully trust, disconnect it from the internet if practical and avoid using it for sensitive account recovery until it has been checked. Update its operating system and security tools, remove software you do not recognize, and review browser extensions and notification permissions. If you suspect persistent malware or remote access, seek qualified technical help rather than repeatedly signing in.
Preserve the original message, sender details, URL, screenshots, timestamps, transaction records, and support case numbers. Do not forward a dangerous link to colleagues or friends as a warning; share screenshots or safely copied details instead. If a work account or company information was involved, notify the appropriate internal security or IT contact promptly.
Cadence and checkpoints
Use a staged recovery schedule so that urgent actions are not lost in a long checklist.
Immediately
- Stop using the suspicious link or responding to the sender.
- From a trusted device, change exposed passwords and any reused passwords.
- Revoke active sessions and remove unfamiliar devices or applications.
- Contact financial institutions if payment or banking information was shared.
- Record the incident and preserve evidence.
Within the next day
- Enable or reset multifactor authentication and recovery codes.
- Check email forwarding, inbox rules, recovery settings, and sent messages.
- Review account activity, payment activity, and password-reset notifications.
- Check the affected phone or computer, especially after a download or installation.
- Notify an employer, school, family member, or service provider if their information may be involved.
During the following weeks
Review important accounts and financial activity regularly. Watch for password-reset messages you did not request, new devices, missing messages, unexpected multifactor prompts, unfamiliar charges, changes to contact details, and calls or texts that use information from the original scam. Keep a dated log of each finding and the action taken.
How to interpret changes
Not every unusual notification proves that an account was taken over, but patterns matter. A single blocked login may be an attempted reuse of an old password. Several password-reset messages, an unfamiliar recovery address, and a new session together indicate that you should escalate the response and contact the service directly.
Pay particular attention to changes that weaken recovery: a replaced phone number, a new email address, disabled multifactor authentication, unfamiliar backup codes, or an email rule that hides security alerts. Also treat unexpected requests for additional codes, gift cards, transfers, or identity documents as part of the incident until independently verified.
When reviewing a message, separate the channel from the claim. An email that appears to come from a bank is not proof that the bank sent it. Open the official app or type the known web address yourself. This habit also applies to text-message scams, QR-code scams, package-delivery messages, and impersonation attempts.
If an account remains inaccessible, use only the provider's official recovery process. Do not pay someone who contacted you unexpectedly and promises to recover the account. Keep your evidence, avoid sending more sensitive information through an unverified channel, and ask what legitimate verification method is available.
When to revisit
Revisit this checklist after every suspected phishing event, even if you only clicked a link. Set a short follow-up checkpoint for the next day, another for the following week, and a monthly review for accounts or identity information that may have been exposed. A quarterly online privacy checklist can also uncover reused passwords, outdated recovery details, forgotten connected apps, and excessive account permissions.
Update your recovery plan when you change phones, email addresses, banks, password managers, or multifactor methods. Recheck it after a data breach notification, a suspicious login alert, a lost device, or a new scam pattern that targets people you know. Website owners and marketers should also review whether a compromised account could expose customer data, analytics access, consent records, or publishing tools; related privacy and script reviews are covered in the Third-Party Script Risk Audit.
Use this final action list: secure the email account first, change reused passwords, revoke sessions, enable multifactor authentication, contact financial providers, check the device, preserve evidence, and schedule follow-up reviews. If you are unsure which step applies, choose the safer path: stop sharing information, use an independently verified contact method, and ask the affected provider for help.
