It happens to everyone — including technology professionals. The text looked real, the moment was busy, and the link got clicked. If that’s why you’re reading this, take a slow breath: clicking a link is rarely the disaster it feels like. What matters is what you do in the next hour. Here is the calm, step-by-step response.

First: what clicking actually does (and doesn’t do)

In most cases, a scam link opens a fake page designed to collect what you type — a look-alike bank login, a “verify your identity” form, a payment screen. Simply looking at that page usually causes no harm by itself. The danger comes from three follow-up actions: typing information, downloading something, or granting permission to a pop-up. If you clicked but did none of those, you can usually just close the page, and your biggest job is a little watchfulness.

Step 1 — Close the page and don’t go back

Close the browser tab or app. Don’t re-open the link “just to check,” and don’t call any phone number that page displayed.

Step 2 — If you typed a password anywhere, change it now

Change it on the real website (type the address yourself or use the official app). If you use that same password on other accounts — especially email — change those too, starting with email, since it can reset everything else. This is the moment unique passwords prove their worth; our guide to memorable strong passwords makes the redo painless.

Step 3 — If financial details were involved, call the bank

If you entered a card number, bank login, or made a payment, call the number on the back of your card — not any number from the message. Banks handle this every day. They can freeze the card, reverse many charges, and watch the account. The faster you call, the more they can do.

Step 4 — If you downloaded a file or granted access, get the device checked

If the link installed something, asked you to “allow” repeated pop-ups, or someone talked you into remote access, have the device looked at before using it for banking. Restart the device, and ask a trusted family member or your community’s recommended technician to run a checkup. Until then, do sensitive tasks on a different device.

Step 5 — Watch the accounts that matter for a few weeks

• Glance at bank and card statements a little more often than usual.
• Read the “sign-in from a new device” emails instead of deleting them.
• If your Social Security number was involved, consider a free credit freeze with the three bureaus — it blocks new accounts from being opened in your name and can be lifted anytime.

Step 6 — Report it and tell someone

Report scams to the FTC at reportfraud.ftc.gov — reports build the cases that shut these operations down. Then tell a person: family, a friend, your community’s front desk. Not because you did something wrong, but because scam scripts travel in waves, and your story inoculates the next ten people who get the same text.

The most important step: skip the shame

Scam pages are built by professionals who test which designs fool the most people. Falling for a well-made one says nothing about your judgment and everything about their craft. The people who fare worst aren’t the ones who click — they’re the ones who feel too embarrassed to act quickly. Click, respond, recover, move on.

Frequently asked questions

I clicked but didn’t type anything. Am I safe?

Very likely yes. Close the page, don’t return to it, and keep a casual eye on your accounts for a few weeks. On a phone that’s up to date, clicking alone rarely causes harm.

Should I turn off my phone or computer?

A simple restart is a fine first step and clears most mischief a web page can do. You don’t need to stop using the device unless you downloaded a file or gave someone remote access.

How do I know if my information is being misused later?

The signs are new-account letters you didn’t request, charges you don’t recognize, or sign-in alerts from unfamiliar places. A credit freeze plus routine statement checks catches nearly all of it early.