Clicked a phishing link? Here's what to do

I only clicked the link

If you clicked but didn't type anything or download anything, the risk is usually low.

1. Close the page. Don't enter anything if it asks.
2. Make sure your browser and device are up to date. Most attacks through a simple click rely on old software.
3. Run a scan with your security software.
4. Watch for the same scam arriving again in a different form, such as a text, a call or another email.

I entered my password

Assume the scammer has it, and act now. Attackers often try stolen passwords within minutes.

1. Change that password on the real site. Type the address yourself or use the official app, never a link from the message.
2. Change it anywhere else you used the same password. Scammers try it on email, banking and shopping sites.
3. Turn on multi-factor sign-in (a code or app prompt as well as your password), if it isn't on already.
4. Sign out of all other sessions. Most services have this in their security settings.
5. If it was your email account, check for new forwarding rules, filters or recovery details you didn't add. Attackers use these to keep watching your mail.

If you can't get back in, see hacked account recovery.

I entered card or bank details, or sent money

1. Call your bank or card provider now, using the number on your card or their official website. Ask them to block the card and stop or recall any payments.
2. Check recent transactions and tell the bank about anything you don't recognise.
3. Report the scam to your local police or your national fraud reporting service. Banks sometimes ask for a report reference.
4. Be careful of anyone who contacts you offering to get your money back for a fee. That's a common second scam aimed at people who were just scammed.

I opened an attachment or installed something

1. Disconnect from the internet. Turn off Wi-Fi or unplug the network cable.
2. Don't type any passwords on that device until it's been checked.
3. Run a full scan with your security software.
4. From a different, trusted device, change the passwords for your email and banking.

If you're not sure the device is clean, ask us before you keep using it.

Someone called and I let them onto my computer

"Tech support" calls and pop-ups that say your computer is infected are scams. Real companies don't call you out of the blue or lock your screen.

1. Disconnect from the internet and switch the computer off.
2. Call your bank if you logged in to online banking or paid anything while they were connected.
3. Remove the remote access program they asked you to install, before you go back online.
4. From another device, change your important passwords, starting with email and banking.

How to spot the next one

• Urgency or fear: "Your account will be closed today", "Unusual sign-in detected", "Final notice".
• A link or sender that's slightly off: an extra word, a misspelling, or a free email address claiming to be a company.
• A request to change payment details, especially by email. Confirm by calling a number you already know.
• Asking for codes: no real company needs the code they just texted you.
• Too good to be true: prizes, refunds or parcels you weren't expecting.

When in doubt, don't use the message. Go to the company's website or app yourself.