What to Do Immediately If You Think You Clicked a Bad Link

First: Take a Breath

You clicked a link in a text message, email, or pop-up, and immediately thought, "Wait — that didn't look right." Your heart rate goes up. You start imagining worst-case scenarios. Someone halfway across the world rifling through your bank account. Your photos stolen. Your contacts getting scam messages from "you."

Breathe.

The simple act of clicking a link — without entering any information — rarely causes immediate harm. Modern phones and computers have layers of protection built in, and most scam links are designed to trick you into voluntarily giving up information, not to magically steal it just because you clicked. Think of it like a stranger handing you a clipboard on the street: taking the clipboard (clicking the link) isn't dangerous. Filling out the form and handing it back (entering your information) is where the damage happens.

So let's walk through exactly what to do, in order, calmly.

Step 1: Disconnect Immediately (30 Seconds)

The first thing to do is stop any ongoing communication between your device and whatever is on the other end of that link.

On a phone (iPhone or Android):

• Swipe down from the top-right corner (iPhone) or top of the screen (Android) to open the Control Center or Quick Settings
• Tap the Airplane Mode icon (the little airplane)
• This turns off both cellular data and Wi-Fi in one tap

On a computer:

• Click the Wi-Fi icon in the corner of your screen (bottom-right on Windows, top-right on Mac)
• Click to disconnect from your network
• Alternatively, physically unplug the ethernet cable if you use a wired connection

Why this matters: if the link you clicked started downloading something malicious in the background, cutting the connection stops that download in its tracks. It's like realizing you left the water running and turning off the main valve — the sooner you do it, the less damage.

Step 2: Don't Enter Anything (Crucial)

If the page you landed on is still visible, you might see something alarming: a warning that your computer is "infected," a login page that looks like your bank, or a form asking you to "verify your identity." These are designed to scare you into acting quickly without thinking.

Do not type anything into that page. Not your name, not your email, not your password, not your credit card number. Close the browser tab immediately.

On a phone: close the entire browser app by swiping it away (don't just minimize it). On iPhone, swipe up from the bottom and flick the browser app upward. On Android, tap the square button and swipe the browser away.

On a computer: close the browser window entirely (click the X, or right-click the browser icon in the taskbar/dock and choose "Quit" or "Close Window").

The single most common way scammers succeed is by presenting you with a fake login page that looks exactly like the real thing — identical logo, identical colors, identical layout. They count on you typing in your real username and password without a second thought. If you didn't type anything, the single biggest threat is already neutralized.

Step 3: Run a Security Scan (2 Minutes)

Now let's check whether anything unwanted made its way onto your device.

On a Windows Computer

Windows comes with built-in security software called Windows Security (formerly Windows Defender). It's actually quite good and you don't need to buy anything extra.

1. Click the Start button and type "Windows Security"
2. Open the app and click Virus & threat protection
3. Click Quick scan
4. Let it run — it usually takes 5-15 minutes

If Windows Security finds anything, it will tell you and offer to remove or quarantine it. "Quarantine" means the suspicious file is put in a locked folder where it can't do any harm — like putting a suspicious package in a locked room until the authorities can look at it.

On a Mac

Macs have built-in protection called XProtect and Gatekeeper that run automatically in the background. There's no "scan" button — the protection is always on. If you want extra peace of mind, you can download the free version of Malwarebytes (from malwarebytes.com — make sure you're on the real site) and run a one-time scan.

On an iPhone or iPad

iPhones and iPads are designed so that simply clicking a link in a web browser cannot install anything malicious. The operating system — the core software that runs your device — is "sandboxed," meaning each app is sealed off from the others, like individual apartments in a building. A problem in one apartment doesn't spread to the others.

Apple reviews every app in the App Store, and you can't install apps from websites the way you can on a computer. The risk from clicking a link on an iPhone is overwhelmingly about being tricked into entering information, not about the device itself being compromised.

Your best protection: keep your iPhone updated. Go to Settings > General > Software Update and install any available updates. These updates often include security fixes.

On an Android Phone

Android phones are more open than iPhones, but Google Play Protect scans apps automatically. To run a manual scan:

1. Open the Play Store app
2. Tap your profile picture in the top-right corner
3. Tap Play Protect
4. Tap Scan

Also, check Settings > Security (the exact path varies by phone brand) and look for any security scan option your phone's manufacturer provides. Samsung phones, for example, include a "Device protection" feature.

Step 4: If You Entered Information, Act Fast

If you did type a password, credit card number, or other sensitive information into the page before realizing it was fake, don't beat yourself up — these pages are designed by professionals to be convincing. But do act quickly.

If You Entered a Password

Immediately go to the real website (type the address yourself — don't click any links) and change your password. Use a strong, unique password you've never used before. If you used that same password on any other sites, change it on those sites too. This is exactly the scenario where having a password manager saves you enormous stress — it can generate and store strong new passwords for you in seconds.

If You Entered Banking or Credit Card Information

Call your bank or credit card company immediately. The phone number is on the back of your card. Tell them exactly what happened: you were tricked into entering your information on a fake website. They deal with this every day and will guide you through the next steps, which usually involve canceling the compromised card and issuing a new one.

If You Entered Your Social Security Number

This is more serious but still manageable. Visit identitytheft.gov, the U.S. government's official resource for identity theft. They will walk you through placing a fraud alert on your credit reports, which makes it much harder for someone to open new accounts in your name. You can also freeze your credit with the three major credit bureaus (Equifax, Experian, and TransUnion) — this is free and prevents anyone from opening new credit in your name.

Step 5: Check for the Common Signs of Trouble (Ongoing)

Over the next few days and weeks, watch for these warning signs:

• Unexpected password reset emails. If you receive an email saying "Here's your password reset link" that you didn't request, someone may be trying to get into your account.
• Unfamiliar logins. Check your email and important accounts for login activity from locations or devices you don't recognize. In Gmail, scroll to the bottom of your inbox and click "Details" in the bottom-right corner. In Outlook, check your recent activity under account settings.
• Unusual bank or credit card charges. Check your statements weekly for the next month. Even small charges (like $1 or $2) can be a scammer testing whether a stolen card number works before making larger purchases.
• Friends or family saying they got strange messages from you. If people tell you they received odd texts, emails, or social media messages from your account, your account may have been compromised.

Step 6: Report It (Optional but Helpful)

Reporting the scam helps protect others. Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org. Forward scam text messages to 7726 (which spells "SPAM" on a phone keypad). If the scam impersonated a specific company (like your bank or Amazon), forward it to that company's fraud department — they actively work to take down fake websites that impersonate them.

What About Those Pop-Ups That Say "Your Computer Is Infected — Call This Number"?

These are called "tech support scams" and they are among the most common — and most profitable — online scams. A page suddenly takes over your screen with flashing warnings and an urgent phone number to call. Everything about it is designed to bypass your rational brain and trigger panic.

It is a lie. Microsoft, Apple, Google, and legitimate antivirus companies will never display a pop-up like this with a phone number to call. If you see one:

1. Do not call the number
2. Do not click anything on the page (even the "X" to close it — sometimes those are fake)
3. Force-quit your browser: on Windows, press Ctrl+Shift+Esc, find your browser in the list, and click "End task." On a Mac, press Command+Option+Esc, select your browser, and click "Force Quit."

If the pop-up reappears when you reopen the browser, it means your browser is set to reopen the pages from your last session — which includes the scam page. Most browsers ask "Do you want to restore your previous session?" when reopening after a force-quit. Say no.

The Most Likely Outcome

Here's the reality that scammers don't want you to know: the vast majority of the time, clicking a suspicious link and then following the steps in this guide results in no harm at all. Your devices have sophisticated protections built in, and most scams depend entirely on you voluntarily providing information. By not entering anything and disconnecting quickly, you've likely already won.

Keep your devices updated, use unique passwords, and trust your instincts. The fact that you recognized something was "off" in the first place means you already have the most important security tool of all: good judgment.