Clicking a suspicious link is not automatically a disaster, but it is a reason to act methodically. This recovery checklist helps you contain the risk, secure affected accounts and devices, report financial exposure, preserve evidence, and monitor for follow-up signs of phishing or identity theft.
Overview
A phishing link may lead to a fake sign-in page, a malicious download, a payment scam, or a page designed to collect personal information. Your next steps depend on what happened after the click:
- You opened the link but did nothing else: Close the page, avoid downloading anything, and monitor the device and relevant accounts.
- You entered a password: Treat that password as exposed. Change it immediately from a trusted device and sign out other sessions.
- You entered payment or identity information: Contact the bank, card issuer, or relevant provider using a verified channel. Watch for unauthorized activity.
- You downloaded or opened a file: Disconnect the device from the internet if you suspect it is behaving unusually, then run trusted security checks and seek technical help if needed.
- You installed an app, browser extension, or remote-access tool: Remove it only if you can do so safely, change important passwords from a different device, and consider professional support.
Do not return to the suspicious message to find a support number or login page. Instead, type the known website address yourself, use a saved bookmark, or contact the organization through a statement, official app, or independently verified contact method. For prevention guidance, see how to spot phishing in emails, texts, and QR codes.
A quick decision tree
- Did you only open the link? Close it, do not interact further, and continue with the device and monitoring checks below.
- Did you submit a username or password? Change that password and every reused password, then revoke active sessions and review account settings.
- Did you submit card, bank, tax, identity, or account-recovery information? Contact the affected provider immediately through a verified channel and document the report.
- Did you download, open, or install something? Stop using the device for sensitive logins until it has been checked. If it is a work device, notify the appropriate security or IT contact.
What to track
Good phishing recovery is partly a one-time response and partly a monitoring task. Create a short incident record while details are fresh. Record the date and time, the message type, the sender or phone number, the link destination if visible, what you clicked, what information you entered, and which accounts or devices were involved. Save screenshots or the original message when possible, but do not click the link again.
1. Account exposure
List every account connected to the exposed information. Start with the account used on the phishing page, then check whether the same password was used for email, banking, shopping, social media, cloud storage, or work services. Email deserves priority because it can be used to reset other accounts.
- Change passwords from a trusted device or a clean browser session.
- Use a unique, long password for each important account.
- Sign out of unfamiliar or all active sessions where the service provides that option.
- Review recovery email addresses, phone numbers, forwarding rules, connected apps, and recent security events.
- Turn on multifactor authentication. An authenticator app or security key may provide stronger protection than text messages, where available.
If you cannot sign in, use the provider's account-recovery page by navigating to the provider directly. Do not trust recovery links sent in follow-up messages.
2. Device and browser changes
Note anything unusual after the click: unexpected pop-ups, new extensions, disabled security tools, unfamiliar apps, battery or data changes, browser redirects, or messages sent from your account. Update the operating system, browser, and security software. Run a scan using a trusted, up-to-date security tool. Remove unfamiliar extensions and applications, but preserve evidence first if the device belongs to an employer or contains information needed for an investigation.
On a phone, review recently installed apps, device-administrator permissions, accessibility permissions, notification access, and profiles or certificates you do not recognize. If you installed remote-access software or entered a device passcode into a suspicious page, get help from the device manufacturer, your employer, or a qualified technician before using the phone for banking.
3. Financial and identity exposure
If you shared card details, contact the card issuer through the number on the card or a verified banking app. If you shared bank credentials, contact the bank promptly and ask what protective steps are appropriate. Review transactions and alerts, and report anything you do not recognize.
If you shared government identification numbers or other identity data, document what was exposed and consider the identity-protection steps available in your country. Credit monitoring and a credit freeze may be relevant in some situations. The guide to freezing credit and monitoring identity theft provides a separate checklist for that decision.
Printable recovery checklist
- ☐ Close the suspicious page and stop interacting with the message.
- ☐ Save the message, sender details, URL, screenshots, and timeline.
- ☐ Identify every password, account, device, and data type involved.
- ☐ Change exposed and reused passwords from a trusted device.
- ☐ Revoke unfamiliar sessions, apps, extensions, and forwarding rules.
- ☐ Enable multifactor authentication and verify recovery settings.
- ☐ Update and scan affected devices.
- ☐ Contact banks, card issuers, employers, or account providers as appropriate.
- ☐ Report the message through the platform or email service.
- ☐ Schedule follow-up checks for accounts, devices, transactions, and identity activity.
Cadence and checkpoints
Use a staged response rather than trying to solve everything at once. The timing below is a practical framework; urgent financial or account exposure should be handled immediately.
Immediately
Stop interacting with the message. If credentials were entered, change them now. If money or payment details were involved, contact the provider now. If a downloaded file is running or the device is behaving strangely, disconnect it from the internet and avoid signing in to additional services on that device.
Within the first day
Review active sessions and security alerts, enable multifactor authentication, inspect email rules and account-recovery settings, and scan the affected device. Tell your employer or school if a work or institutional account was involved. Warn contacts if your account may have sent fraudulent messages.
Over the next week
Check bank and card activity, password-manager records, account alerts, and device behavior. Look for password-reset notifications, unfamiliar login prompts, new contacts, or messages sent without your knowledge. Keep a dated record of reports, case numbers, disputed transactions, and actions taken.
Monthly or quarterly
Review important account sessions, recovery methods, connected applications, browser extensions, phone permissions, and financial alerts. Confirm that old or reused passwords have been replaced. This recurring review is especially useful after a phishing incident because attackers may wait before attempting account takeover or impersonation.
How to interpret changes
Not every unusual event proves that an account or device was compromised, but patterns should influence your response.
- A single suspicious login alert: Verify whether it was you. If not, change the password, revoke sessions, and check recovery settings.
- Repeated password-reset messages: Treat them as a possible account-takeover attempt. Do not approve unexpected prompts or use links in the messages.
- New email forwarding rules or filters: Remove unauthorized rules and review recent messages for altered payment instructions or impersonation.
- Unexpected financial activity: Contact the provider through a verified channel and follow its fraud process. Preserve transaction details.
- Continuing device problems: Stop entering sensitive information on the device and seek trusted technical assistance.
- No visible change: Continue monitoring. The absence of an alert does not prove that no information was collected.
Separate confirmed events from possibilities in your notes. For example, “password entered on fake page” is confirmed, while “attacker accessed email” is a possibility until account logs or other evidence support it. This distinction helps you choose proportionate action without ignoring risk.
Website checks can help prevent a second mistake, but a padlock or familiar logo is not proof that a page is legitimate. When assessing a destination, use the address you know, inspect the domain carefully, and avoid entering information merely because a page looks professional. See how to check whether a website is safe before signing in or paying.
When to revisit
Revisit this checklist whenever a new detail changes the exposure: you discover that a password was reused, notice a download, receive an unexpected login alert, find a new app or extension, or see an unfamiliar transaction. Also schedule a monthly check for the first few months after a serious incident, then include the account and device review in your normal online privacy routine.
Update your personal checklist when your primary email address, phone, password manager, banking providers, or work systems change. Review the recovery and reporting links before you need them, since scammers often exploit urgency with fake support pages. The online privacy checklist can help with broader account and data-protection maintenance.
Start now: write down what happened, secure the highest-value account first—usually email—then handle financial exposure, device checks, and follow-up monitoring in that order. A fast, documented response is more useful than trying to determine with certainty whether the link was dangerous before taking sensible precautions.
