iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Act promptly, but do not assume that opening a link alone proves your email account or device was compromised. Use your provider’s official app, a saved bookmark, or an address you type yourself—not the message you clicked—to determine what happened, change credentials if necessary, revoke access, and inspect account activity.
The decisive questions are whether you entered a password or verification code, submitted other personal information, downloaded or ran a file, or approved an app permission. The steps below follow those branches so you can contain the most serious risks first.
Start with a 10-minute incident check
Move away from the suspicious message and write down the approximate time, the account involved, what you entered, and whether anything downloaded. Do not click the message again to investigate. Open your email provider through its official app, a browser bookmark you created earlier, or a web address you manually enter.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches- Only viewed a page: close it and continue with account and device checks. A page view does not by itself establish stolen credentials or malware.
- Entered a password: treat that password as exposed. Change it immediately at the provider and anywhere else it was reused.
- Entered a one-time code: secure the account immediately and inspect sessions, recovery methods, and connected applications. A code can authorize a sign-in while it is valid.
- Entered personal, payment, or bank information: follow the account steps and contact the affected institution using an independently verified number or website.
- Downloaded or opened a file: stop using the file, update the operating system and browser, and perform trusted-device security checks.
- Selected Allow, Grant, or another consent prompt: revoke the unfamiliar application’s access; changing a password alone may not invalidate its token.
Microsoft’s phishing guidance recommends recording what information was shared and where it was entered when you suspect a successful phish.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What each type of exposure means
| What happened | Primary risk | First action |
|---|---|---|
| Opened a page and entered nothing | Possible tracking, deceptive prompts, or browser exploitation; no evidence yet that credentials were disclosed | Close the page, check downloads and extensions, then review account activity |
| Entered an email password | Account takeover and reuse against other services | Change the password through the official provider and every service that reused it |
| Entered a one-time code | An attacker may have completed a sign-in during the code’s validity | Change the password, review sessions and security events, and sign out unknown access |
| Approved an application | Persistent API access that can survive a password reset | Revoke the application in account security settings and then complete the other checks |
| Downloaded or ran a file | Malware, credential theft, or device compromise | Disconnect risky activity, update software, and use trusted security guidance |
| Submitted card, bank, or identity data | Fraud or identity theft beyond the email account | Contact the relevant provider through a verified channel and monitor for misuse |
If you entered a password or verification code
Change the exposed password at the real provider
Use the provider’s official account page or app. Choose a new, unique password that has never been used on another site. Do not follow a password-reset link from the suspicious email. If the same password protected other accounts, change those too, prioritizing services that can be reached through your email address or that use the same credentials.
Microsoft advises changing affected and reused passwords immediately. Google’s account guidance likewise tells users to change the Google password and passwords reused on other apps and sites.
Secure recovery methods
Open the account’s security settings and check every recovery and sign-in method. Remove phone numbers, email addresses, authenticator devices, passkeys, or backup codes you do not recognize. Replace a recovery address that an attacker may control. Generate new backup codes if the provider supports them and store them privately.
Turn on multifactor authentication
Multifactor authentication (MFA) adds a second factor when a password is compromised. CISA describes MFA as an additional layer of protection. Enable it as soon as the account is under your control, then test the sign-in and recovery process while you still have access.
| Method | Phishing resistance | Recovery and support considerations |
|---|---|---|
| FIDO2 hardware security key | Strongest option in the cited CISA comparison; designed to resist ordinary phishing pages | Requires provider support, a registered backup key or another recovery method, and keeping the key available |
| Authenticator app | Generally stronger than SMS, but codes can still be entered into a convincing fake site | Back up or transfer the authenticator securely and retain provider-approved recovery options |
| SMS code | Less preferable in CISA’s comparison because phone-number attacks can intercept codes | Widely supported; keep the phone number current and use a stronger method when available |
CISA states that “MFA helps prevent unauthorized access, even if credentials are compromised, making it one of the most effective ways SLTTs can protect operations and public safety.” That is guidance for state, local, tribal, and territorial government organizations, not a promise that MFA blocks every attack. Provider support and a workable backup method determine which option you can actually use.
Review sign-ins, devices, and active sessions
From the provider’s official security dashboard, inspect recent security events, signed-in devices, browsers, and active sessions. Sign out of anything you do not recognize and follow the provider’s recommended security workflow. Record suspicious device names or times before removing them if you may need the information for an employer, bank, or investigation.
Do not treat a location or timestamp alone as conclusive proof. Google notes that session times can reflect background communications, and a single device can create multiple sessions. Compare the device type, browser, approximate time, and your own activity before deciding whether an event is unfamiliar.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →For Google accounts, Google’s device-access instructions explain how to inspect and remove account access. Other providers use different labels, so use their official security and compromised-account pages rather than copying a menu path from another service.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Revoke unfamiliar app access
Open connected-app, third-party access, or application-security settings. Remove applications you do not recognize, no longer need, or approved immediately before the incident. Check both the email provider’s list and any identity platform that manages sign-in for it.
This step matters after an “Allow” or consent screen. The FBI Internet Crime Complaint Center’s 2026 advisory explains: “OAuth consent phishing provides actors with persistent access to a target’s account because once permission is obtained, it can only be revoked by the victim invalidating the token in their application security settings; not by changing the password.” Read the FBI IC3 advisory for that warning. A password reset is still necessary when a password was exposed, but it is not a substitute for revoking an unwanted token.
Inspect email-specific settings
Gmail accounts
In Gmail and the associated Google Account, check the following for changes you did not make:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Mail delegation and delegated users
- Automatic forwarding addresses
- Filters that archive, delete, mark as read, or forward messages
- Scheduled messages and automatic replies
- Outgoing address, display name, and send-as settings
- Blocked addresses
- IMAP and POP access
Also inspect Sent, Trash, and other folders for messages you did not write, unexpected deletions, or replies from contacts who received unusual mail. Google’s account-activity guidance and compromised-account checklist identify these areas as useful places to look.
Other personal providers
Use the provider’s own account-activity and compromised-account checklist. Look for forwarding rules, delegates, filters, aliases, automatic replies, external mail access, and unfamiliar recovery settings, but do not assume another service uses Gmail’s menu names.
Work and school mailboxes
Notify your organization’s IT or security team promptly. Administrators may need to revoke sessions centrally, remove malicious forwarding rules, reset tokens, preserve logs, or check messages sent to other staff. Do not delay reporting while trying to complete every consumer-account step yourself.
If a file was downloaded or opened
Clicking a link is not proof that malware installed. The risk changes when a file was downloaded, opened, or allowed to run, when the device behaves unusually, or when account activity shows a new device you cannot explain.
Recommended Free Tools
- Stop opening the downloaded file and do not enter more credentials into any related prompt.
- Update the operating system, browser, and security software from their official update mechanisms.
- Run a scan with trusted, up-to-date device-security software. Follow the software maker’s instructions for quarantine or removal.
- Review browser extensions and remove unfamiliar or recently installed items. Google includes trusted antivirus and extension review among its device-security steps for a potentially compromised account: Google compromised-account guidance.
- From a device you trust, repeat password, MFA, session, and app-access checks if the affected computer may have captured credentials.
The available guidance does not establish that every click requires paid antivirus, a cleanup service, or a factory reset. Escalate to qualified technical support when you cannot determine whether a file ran, security tools report an infection, or the device remains abnormal.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Contain financial, identity, and message-based damage
Report the message
Use the email service’s built-in Report phishing or Report spam function. Keep the original message and headers if your workplace, bank, or law-enforcement agency may need them, but do not interact with its links or attachments again.
Microsoft recommends reporting phishing in Outlook and notifying workplace IT for work or school accounts. The exact report control differs by provider.
Protect payment and bank accounts
If you submitted card or bank details, call the institution using the number on a physical card, an official statement, or a web address you enter yourself. Ask whether the account or card should be frozen, replaced, or monitored. Do not use contact details supplied by the suspicious message.
Report losses or identity theft
If money was lost or identity theft occurred, report it to local law enforcement and follow the affected institution’s fraud process. Preserve the message, timestamps, transaction records, and screenshots without revisiting the malicious site.
If you can no longer sign in
Use only the provider’s official account-recovery route. Start from the provider’s home page or official app, not from a message promising to restore access. Provide the strongest ownership information requested, complete recovery on a device and network you normally use when possible, and notify organizational IT for a managed account.
After recovery, repeat the full review: change the password, replace recovery methods, enable MFA, sign out unknown sessions, revoke connected applications, inspect mail rules, and check sent and deleted messages. Losing access means you should assume the attacker may have changed settings; it does not identify which settings were changed.
How quickly should you act?
Start with the highest-impact branch immediately rather than waiting for an account alert. A password or one-time code should be treated as exposed as soon as you realize it was entered. Change it at the real provider, then address reuse on other services. If an app permission was approved, revoke it in application-security settings during the same session because a token can remain active after a password change.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11If you only viewed a page and entered nothing, close it, check whether a download occurred, and review security events when practical. Continue monitoring for unfamiliar sign-ins, messages, recovery changes, or contacts reporting mail you did not send. The absence of an alert does not prove that no action is needed, but a click alone is not proof of takeover.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Common mistakes to avoid
- Returning through the original message: use a bookmark, official app, or manually typed address for every security action.
- Changing only the email password: update every reused password and revoke unfamiliar application access.
- Trusting a location by itself: compare device, browser, time, and your own activity before labeling a session suspicious.
- Deleting evidence immediately: preserve the message, headers, screenshots, and timestamps if an employer, bank, or investigator may need them.
- Installing an unrequested cleanup tool: use trusted device-security software and official update channels; a paid service is not automatically necessary.
- Ignoring organizational reporting: work and school accounts may require central token, session, and mail-rule removal.
Harden the account after the incident
Use distinct credentials everywhere
A password manager can generate and store a different password for each service. It does not contain an incident by itself, but it makes the unique-password requirement practical and reduces damage from future reuse.
Add a phishing-resistant option
Consider a FIDO2-compatible hardware security key after immediate recovery. Confirm that your provider supports the key, register a backup key or another recovery method, and store the devices securely. A key improves resistance to credential-phishing pages but does not remove the need to review app permissions, recovery settings, and sessions.
Change how you reach account security pages
Bookmark the provider’s real sign-in and security pages, use the official mobile app, or type the address manually. Treat urgent messages, unexpected invoices, delivery notices, and account warnings as untrusted until verified through a separate channel.
Keep recovery information current
Maintain a recovery email and phone number you control, store backup codes offline, and periodically review registered devices and applications. Remove obsolete access so an old device or service cannot become a hidden route back into the account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical decision checklist
- No data entered, no download: close the page, check downloads and extensions, review security events, and report the message.
- Password entered: change it at the provider, change every reuse, enable MFA, and review recovery methods, sessions, applications, and mail settings.
- Verification code entered: perform the password-and-session branch immediately, even if the code has expired.
- App permission approved: revoke the application token in security settings; do not rely on a password change alone.
- File opened or device behaves oddly: update and scan the device, remove suspicious extensions, and repeat account checks from a trusted device.
- Financial or identity data submitted: contact the relevant institution through verified details and document the incident.
- Work or school account: involve IT or the security team as soon as possible.
These branches let you match the response to what actually happened instead of treating every click as a confirmed compromise or dismissing a serious credential or consent exposure.
Frequently Asked Questions
I clicked a suspicious link but did not enter anything. Am I hacked?
Not necessarily. A click alone does not establish that credentials were stolen or malware installed. Close the page, check downloads and browser extensions, review recent account activity, and report the message. Escalate device checks if a file ran or the device behaves unusually.
I entered my email password on the suspicious site. What should I do first?
Open the provider through its official app, a saved bookmark, or a manually entered address and change the password immediately. Use a new, unique password, then change it anywhere it was reused, especially on accounts reachable through that email address. Enable MFA and review recovery methods, sessions, connected applications, and mail settings.
Is changing my email password enough?
No. A password reset does not necessarily revoke an OAuth or other application token. Remove unfamiliar connected apps in application-security settings, sign out unknown sessions, inspect recovery methods and email rules, and change reused passwords on other services.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
What if I entered a one-time verification code?
Treat the account as needing immediate protection. An attacker may have used the code while it was valid. Change the password through the real provider, inspect security events and sessions, remove unfamiliar access, verify recovery details, and enable MFA.
What if I clicked Allow on an app-consent screen?
Revoke the unfamiliar application in the provider’s connected-app or application-security settings. Consent-phishing access can persist through an API token after a password change, so do not rely on the reset alone. Continue with the password, session, recovery, and mail-setting checks.
Should I buy antivirus or pay for a cleanup service?
Not solely because you clicked a link. If a file was downloaded or run, update the operating system and browser, use trusted up-to-date security software, review extensions, and seek qualified help if an infection is reported or the device remains abnormal.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How do I secure a work or school mailbox?
Notify the organization’s IT or security team promptly. They may need to revoke sessions centrally, remove forwarding rules, reset tokens, preserve logs, and check messages sent to other staff. Follow the organization’s recovery process even if you also complete personal account checks.
What should I do if bank or card details were submitted?
Contact the bank or card provider through a number on a physical card, an official statement, or a web address you enter yourself. Ask about freezing, replacing, or monitoring the account. If money was lost or identity theft occurred, follow the fraud process and report it to local law enforcement.
Which MFA method should I choose?
Use the strongest method your provider supports that you can recover reliably. CISA’s comparison places a FIDO2 hardware security key ahead of authenticator apps, with SMS less preferable. Register a backup key or another approved recovery method and keep it available.
The Bottom Line
A suspicious-link click is a signal to investigate, not proof of takeover. Secure the real account immediately when a password, code, or permission was exposed; revoke app tokens, inspect sessions and mail rules, address device or financial risks, and involve IT or the relevant institution when the account or information requires it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
