Clicked a scam text link? What to do next

First: stop the conversation and leave the page

Close the page. Do not reply, approve another prompt, or call a number supplied by the message or pop-up. If you need to check a delivery, bill, or account alert, open the company's app yourself or use a contact route you already trust. A logo on the page is not verification.

• Money moving or payment details shared? Contact the payment provider now.
• Someone controlling your screen? End the remote session and disconnect that device from the network. Use another trusted device to contact your bank or account provider, then follow the device steps.

Do not wait to finish this guide before taking those urgent steps.

For a work or school device or account, contact your IT team through its usual reporting route. Tell them what happened before attempting cleanup or a reset.

Sources: FTC phishing guidance; Apple guidance on deceptive messages and support calls.

1. You opened the page or allowed website notifications

A visit alone does not tell you that an account was taken over, and it is not proof that the device is safe. Review whether you shared information, approved a sign-in or account-access prompt, or downloaded or opened a file. If you did, follow the matching section below.

• Leave the suspicious page closed. Do not revisit it to investigate.
• Install available browser and operating-system updates through the device's normal settings, not through the message.
• Check account alerts through the service's own app. If you find activity you did not initiate, use its official account-security process.

Allowed website notifications? Block the site in your browser's notification settings without reopening the suspicious page. For example, use Chrome's notification controls. A notification claiming you have a virus is not itself proof of infection. Do not follow its cleanup link.

A factory reset or changing every password is not the starting step for a click-only report. A persistent warning, unfamiliar download, or unexpected account activity needs further investigation; do not assume that closing the tab fixed it.

Sources: FTC phishing guidance; Google account-security guidance.

2. You entered a password, shared a code, or approved access

As a precaution, use these steps if you typed a password on the suspicious page even if you did not press Submit. Use another trusted device if you also installed suspicious software or allowed remote access.

1. Open the real service independently. Change the exposed password to a unique one. Change it on other accounts where you reused it.
2. Review recent security activity and signed-in devices or sessions. Sign out sessions you do not recognize using the provider's instructions. Do not assume a password change ends every session; Google documents exceptions.
3. Check recovery email/phone details, two-factor sign-in methods, and email forwarding rules or filters. Correct unfamiliar changes using the provider's instructions.
4. Turn on or review two-factor authentication. A shared one-time code or an approved sign-in prompt needs attention even if you did not type a password. Reject further sign-in prompts you did not start.
5. If you cannot sign in, use the provider's official recovery process. Do not give a supposed helper another verification code.

If you approved an app's access to your account, review connected apps and revoke the unwanted connection. Changing a password is not a substitute for reviewing that permission.

Official instructions: Secure a Google Account; review Google linked-app access; recover and secure an Apple Account.

3. You shared payment details or sent money

Contact the provider immediately, even if you shared payment details but no charge has appeared. Use its official app or a known number, such as the number on your card, not contact details in the suspicious message.

• Card or bank details, a card payment, or bank transfer: contact your bank or card issuer.
• Payment app or wire-transfer company: contact the service you used to send the money.
• Gift card: contact its issuer; keep the card and receipt.
• Cryptocurrency: contact the exchange or ATM operator you used, if applicable.

Explain what you shared or authorized. Ask how to protect the account or card and whether a payment can be stopped, reversed, or refunded. Recovery is not guaranteed.

Keep transaction references and the original message for your provider. Do not pay another fee to someone promising to recover the money; see the FTC warning about recovery scams. If you also entered a banking password or a code, follow the account steps above and tell the bank.

For exposed identity information in the United States, use IdentityTheft.gov for steps suited to what was exposed. Outside the U.S., use your country's official fraud or identity-theft service.

Source: FTC: what to do after a scam, including payment-provider contacts and recovery steps.

4. You downloaded or installed something

Downloaded but did not open it? Keep the file closed. Do not install it to see what it does. Tell IT if this is a managed device.

Opened or ran a file, installed an app/extension/profile, pasted a command, or allowed remote access? Treat that as a separate device-security problem. Ending a remote session stops that session; it does not establish that the device is clean. Avoid sensitive sign-ins on that device while you get help.

• Computer: follow the relevant Windows, Mac, or Chromebook steps in Google's unsafe-software guide and its device-maker links. If your existing trusted security tool offers scanning, update it, run a scan, and follow its removal instructions. Review unfamiliar browser extensions. A clean scan does not prove every risk is gone.
• Android: open the Google Play Store, tap your profile, then Play Protect. Follow its warnings and keep protection enabled. See Google Play Protect's guidance.
• iPhone or iPad: use official Apple Support to review unfamiliar apps, profiles, or persistent problems. Let IT review work or school profiles before removing them. Do not install an advertised "cleaner" from a pop-up.

If you are unsure what was installed, seek help from the device manufacturer or a trusted technician. Do not buy a cleaner or reset the device just because a warning page tells you to. On a work device, let IT direct removal and evidence preservation. A reset is not a substitute for securing an exposed account.

More guidance: Apple: avoid malicious commands and fake support; FTC: someone had access to your device.

After the urgent steps

Make a private note of what you shared, downloaded, approved, or paid and whom you contacted. Use your messaging app's report-junk or spam option. In the U.S., you can also report the scam at ReportFraud.ftc.gov. Reporting does not replace contacting your bank or securing an account.

Do not send GNS passwords, codes, card numbers, identity documents, or copies of sensitive messages. Complete recovery with the relevant provider.

When the immediate problem is under control, practice opening an important website through a known route. The free cybersecurity assessment can help you plan everyday improvements; it is not a malware scan or an incident diagnosis.