Clicked a Phishing Link? What to Do Next, Step by Step

You tapped it. The page looked like your bank, your university or a parcel service, and something felt off a second too late. Now what?

Breathe first. A click on its own is often fixable, and what you do in the next hour matters far more than the click. This guide takes you through it in order, from the device to your accounts to your money.

College Life, the global club for young internationals, is working with Bitdefender to help moved-abroad 18 to 35s keep their devices, data, money and identity safe while they live their whole lives online in a new country. In line with this mission, Bitdefender is providing College Life Club members with 50% off the first year for young professionals and graduates, and a free-trial option for students. Become a member of College Life Club (free) to get this benefit right now.

Key Takeaways

A click on its own rarely empties an account; typing a password, opening a download or paying is what does the damage.
Disconnect the device and run a full scan before you log into anything else on it.
Change any password you typed, from a different device, and change it everywhere you reused it.
If you paid or shared ID, call your bank first and report the fraud second.
Checking a link or message before you tap is far cheaper than any clean-up afterwards.

What a Phishing Link Can Actually Do

A phishing link is a link built to look like it comes from someone you trust, so you hand over something you should not. The page behind it usually wants one of three things: your login, your card, or a way onto your device. That last one is why a scan comes first, and Bitdefender's scam protection sits inside its antivirus for this moment: it checks the device for malware and warns you about pages carrying phishing or fraudulent content.

So how worried should you be right now? That depends on what you did after the page opened. Phishing is not rare, and you are not careless for falling for it. The FBI's Internet Crime Complaint Center logged 193,407 phishing and spoofing complaints in 2024, more than any other crime type, according to its 2024 report.

The reassuring part is that most of the damage needs a second step from you. If something was installed, a proper scan finds it; if nothing was typed, there is usually nothing for the scammer to use.

You only opened the page

Opening a phishing page is usually the least harmful case, because most of these pages need you to type or download something.
An updated phone or laptop makes it far harder for a page to install anything just because you opened it.
You still run the scan in the next section, because you cannot see what a page did in the background.

You typed something in

A password, a one-time code or card details typed into a fake form go straight to the scammer, often within seconds.
This is the case that needs speed: the scammer may try the login while you are still reading this.
Jump to the password section below as soon as the device is offline.

You downloaded a file

A file from a phishing page, especially an app, a "document viewer" or an invoice that wants permissions, may carry malware.
Do not open it again, and do not delete it in a panic before the scan has looked at it.
Malware that steals data needs the internet to send it, which is why disconnecting comes first.

You scanned a QR code

A QR code is just a link you cannot read, so it counts as a click.
The Anti-Phishing Working Group saw millions of emails a day carrying QR codes that lead to phishing sites, according to its 2025 trends summary.
Treat it as you would a tapped link: check what you typed, then follow the steps below.

Knowing which of these you did tells you how far down this guide you need to go. Everyone starts with the next section.

Clicked a Phishing Link? Your First Ten Minutes

The first ten minutes are about containing the problem on one device. Do these three things before you try to fix any account.

Here is what most people want to know first: should you switch the device off? Not yet. Cut the connection instead, because a scan needs the device running, while disconnecting stops anything active from sending data out.

Close it and disconnect

Close the tab or app the phishing link opened, without typing anything else into it.
Turn off Wi-Fi and mobile data, or unplug the cable on a laptop.
If the device is a work or university laptop, tell the IT team now; they may need to block the same link for everyone.

Run a full scan

The UK's National Cyber Security Centre advises a full antivirus scan if you opened a link or installed software, and letting the antivirus clean up what it finds, in its scam guidance.
Choose the full scan, not the quick one; it is slower, but it checks every file rather than the usual hiding places. No antivirus yet? Install one from the official source on a clean connection; the antivirus with scam protection mentioned above runs a full scan from its main screen.
If anything is quarantined, leave it there, and only reconnect once a second scan after a restart comes back clean.

Write down what happened

Note the time, the message, the sender and what you typed or downloaded, while it is fresh.
Take a screenshot of the original message before you delete it, because the bank or the police may ask for it.
This note becomes your checklist for the next sections, so you forget nothing at midnight.

Do not skip the note because you feel embarrassed. Banks, IT teams and police deal with phishing every single day, and a clear timeline makes their job, and your refund, much faster.

Your email deserves first place on that checklist, because it can reset almost every other account. If you have not yet, take ten minutes to secure your email with a second login step once the device is clean. With the device contained, the next job is the accounts.

If You Entered a Password or Code

A password typed into a fake page is now the scammer's password. The aim of this section is to make it worthless before they use it.

So which account do you change first? The one you typed into, then your email, then anything that shares the same password. The NCSC's advice is to change the password on any account that uses the same one, which is the step most people skip.

Change it from another device

Use a different phone or laptop, ideally on mobile data, in case the first device is still compromised.
Go to the real site by typing the address yourself or opening the official app; never reuse the phishing link.
Pick a new password that is long and has never been used anywhere else.

Change every shared password

Scammers try a stolen password on email, banking, shopping and social media sites within hours, because reuse is common.
List every account where you used the same or a similar password, and change each one.
Our password rules guide covers what a strong replacement looks like.

Sign out everywhere

Most major services let you log out every device from the security settings, which kicks out anyone already inside.
The NCSC's guide to recovering accounts lists this step, along with checking your email settings for forwarding rules you did not create.
Check recent logins for places or times that do not match yours.

Turn on two-step login

Two-step login means a second check, usually a code from an app, on top of the password.
It stops a stolen password from working on its own, which is the point.
If you typed a one-time code into the phishing page too, change the password straight away; that code may already have been used to get in.

A data breach check is worth doing at this point, because the same email may already sit in older leaks. The Data Breach Detection included in that same antivirus checks your accounts against known breaches, which tells you whether this was the first leak or one of several and which passwords to change next.

If You Paid or Shared Your ID

Money and identity documents need a different kind of speed. Here the first call goes to a person, not a settings page.

So is the money gone if you entered your card on the fake page? Not always. Banks can often stop a payment that has not settled yet, and they can block the card before a second charge. Abroad, the hard part is often finding the right number at the right hour.

Call the bank first

Use the number on the back of your card or inside your banking app, never a number from the message.
Ask the bank to block the card, stop any pending payments and flag the account for fraud.
If you sent a bank transfer, say so straight away; transfers are harder to reverse, and time matters.

Watch for follow-ups

Scammers who got one payment often return with a second message, posing as the bank's fraud team or the police.
A real bank will never ask you to move money to a "safe account" or read out a code.
Before replying to any follow-up, paste it into Bitdefender's free Scamio chatbot, which works on the web and in WhatsApp and gives a quick view on whether the message is a scam.

Tell whoever was impersonated

If the message copied your university, landlord or employer, tell them; they often warn everyone else the same day.
Universities in particular see the same fake "tuition refund" or "account suspended" message hit hundreds of students at once.
Forward the original, with the sender's address visible, to their IT or security contact rather than to a general inbox.

Report it where you live

Report a card or bank fraud to the bank first, then to the police where you live now if money was taken.
If you have a US Social Security number or a US bank account, the FTC's recovery site creates an official Identity Theft Report and a step-by-step recovery plan.
Our guide to a police report explains which country to file in when your life spans two.

If you uploaded a passport or a residence permit to a fake form, tell the issuing office and keep an eye on any account that uses that document. With the urgent part done, it is worth making sure there is no next time. A layer that checks every link for you is the easiest way, and on Android and iOS the scam protection from the first section flags harmful links in your text messages in real time.

Stop the Next Phishing Link Before You Tap

Most phishing works because the message arrives at a busy moment and asks for a fast decision. The fix is a few habits that slow you down by ten seconds.

So what actually gives a phishing link away? The NCSC lists authority, urgency, emotion, scarcity and current events as the tell-tale signs in its guide to spotting scams. If a message uses two of them at once, stop and check.

Check the sender, not logos

Logos, colours and signatures are easy to copy; the sender's real address and the link's real domain are not.
Press and hold a link on a phone, or hover on a laptop, to see where it really goes before you tap.
A domain that is one letter off, or has extra words before the real name, is the most common tell.

Open apps, not links

When a message says there is a problem with your bank, visa, parcel or tuition, open the official app or type the address yourself.
Real problems show up inside your account too, so you lose nothing by skipping the link.
This one habit beats almost every disguise, including the fake recruiter messages that target new arrivals looking for work.

Let something check for you

You will not catch every fake on a tired evening, so let software carry part of the load.
On laptops and phones, web protection from Bitdefender warns you about pages that carry malware, phishing or fraudulent content before you type anything in.
For a message you are unsure about, a free checker such as Scamio gives a second opinion in seconds, at no cost.

Report what you receive

Forward phishing emails to your email provider's report button, and to the organisation being copied, if it has a reporting address.
Reporting helps take the page down faster, which protects the next person on your course.
Delete the message once it is reported, so nobody in the flat taps it later by mistake.

These habits take a week to become automatic. After that, a phishing link feels obvious long before it feels urgent. Share them with your flatmates too, since a shared Wi-Fi network and a shared laptop mean one person's click can become everyone's problem.

Conclusion

A phishing link is a bad moment, not a disaster. Contain the device, change what you typed, call the bank if money moved, then report it, in that order. Most people who act within the first hour lose nothing more than an evening.

The habits matter more than the clean-up. Check the sender, open the app instead of the link, and let a scam checker look at anything that feels rushed. The purpose of this guide was to help you keep your devices, data, money and identity safe while you live your whole life online in a new country. To help you on this journey, College Life has partnered with Bitdefender to make your life easier. Join College Life Club for free and start taking advantage of this today.

FAQ

What happens if you click a phishing link but do not enter anything?

Usually very little, especially on an updated phone or laptop. Some pages try to push a download or run something in the background, so disconnect, run a full scan and watch your accounts for a few days. If the scan is clean and you typed nothing, you are very likely fine.

Can a phishing link hack my phone?

It is rare for a page to take over an updated phone just by being opened. The real risk is what the page asks you to do next, such as installing an app, giving permissions or typing a login. Keep the phone updated and never install anything a message pushes you towards.

Should I delete the phishing email or text?

Report it first, then delete it. Take a screenshot before you do, in case your bank or the police ask for it later. Deleting it also stops a flatmate or family member from tapping it on a shared device.

How do I report a phishing email?

Use the report or "phishing" button in your email app, and forward it to the organisation being impersonated if it has a reporting address. In the UK the NCSC runs a reporting service, and in the US the FTC handles fraud reports. Reporting helps get the fake page taken down.

Will my bank refund money lost to a phishing link?

It depends on the country, the bank and how the payment was made. Card payments are often easier to dispute than bank transfers, and speed matters in every case. Call the bank as soon as you notice, using the number on your card or in the app.