Clicked a scam link? What to do right now

It happens to careful, smart people every day. Scams are designed to look real. What matters now is what you do next, and most of it you can do in the next hour.

First: what exactly happened?

The steps depend on how far it went. Find the line that fits:

• You clicked the link but didn’t type anything. Close the page. The risk is usually low. Skip to step 5.
• You typed a password. Start at step 2.
• You typed card or bank details, or a code sent to your phone. Start at step 1.
• You let someone control your computer, or installed something they asked for. Start at step 3, then do the rest.

Step 1. Call your bank or card company

Use the number on the back of your card or on your statement, not one from the text or email. Tell them what happened. They can block the card, watch for strange charges and stop transfers that haven’t gone through yet. If you sent money by wire or a payment app, say so right away; speed matters.

Step 2. Change the password

Go to the real website or app yourself, by typing the address or opening the app you already use. Don’t use the link. Change the password you gave away. If you use that same password anywhere else, change it there too, starting with email and banking.

While you’re there, turn on two-step sign-in (sometimes called two-factor or 2FA). It means a password alone isn’t enough to get into your account.

Step 3. If someone was on your computer

1. Turn off Wi-Fi or unplug the internet cable so they can’t reconnect.
2. If they had you install a program such as AnyDesk, TeamViewer or something you don’t recognize, uninstall it.
3. Assume anything you typed while they were connected was seen. Change those passwords from a different device, like your phone.
4. Have the computer checked before you use it for banking again.

Step 4. Protect your email

Your email is the key to everything else, because password resets go there. Change your email password, check that the recovery phone number and backup email are yours, and look for forwarding rules you didn’t set up.

Step 5. Watch for the follow-up

Scammers often call back pretending to be the bank, the police or a "refund department" offering to help you get your money back. That’s the same scam, round two. Hang up and call your bank yourself.

Step 6. Report it

• File a report at ReportFraud.ftc.gov.
• If your Social Security number or ID was taken, go to IdentityTheft.gov for a recovery plan.
• Consider a free credit freeze with Equifax, Experian and TransUnion. It stops anyone from opening new credit in your name, and you can lift it whenever you need to.
• DC, Maryland and Virginia each have a consumer protection office through the attorney general that takes scam reports too.

Want to make it harder for the next one to get through? Our guide to spotting scam calls and texts covers the settings that block many of them.