What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If you clicked a suspicious link, stop interacting with the message, close the page, and determine exactly what happened next. Clicking by itself does not prove that your account or device was compromised, but entering credentials, disclosing financial details, or downloading a file changes the response. Use a trusted device and reach the purported company through an address, app, phone number, or contact method you already know is genuine—not through the message you received.
First, identify which situation applies
Your next step depends on the action you took, not merely on the fact that a message looked suspicious. Use this triage to choose the appropriate path, then follow the detailed instructions below.
| What happened | Primary concern | Immediate priority |
|---|---|---|
| You clicked, but did not type information, download a file, or install anything | The page may have attempted a scam or malware delivery; compromise is not established | Close it, verify the claimed issue through a known-good channel, and avoid further interaction |
| You entered a password, verification code, or account details | Someone may be able to access or take over the account | Change the affected and reused passwords from the real service, enable MFA, and review account activity |
| You supplied bank, card, Social Security, or other identity information | Fraud or identity theft | Call the financial institution through a trusted number and use IdentityTheft.gov if identity theft is suspected |
| You downloaded, opened, or installed a file | Malware may be present on the device | Stop using that device for sensitive logins, update trusted security software, and scan it |
| A work or school account or device was involved | The organization, its data, or other users may be exposed | Notify IT or the security contact immediately and follow internal incident procedures |
If you clicked but did not enter anything
Close the suspicious tab or window and stop replying to the email or text. Do not enter a password, payment number, one-time verification code, or personal detail merely because the page asks for it. Unexpected links can lead to fake login pages, requests for sensitive information, or harmful software; the fact that a page loaded does not establish that any of those outcomes occurred.
Verify the claimed problem independently
If the message says your account is locked, a payment failed, or a delivery needs attention, open the company’s official app or type its address yourself. You can also call a number printed on a card or statement, or use a contact method you saved previously. Do not use a link, telephone number, QR code, or reply address supplied by the suspicious message.
#1 Best Overall
Preserve useful details without reopening the trap
Record the sender, subject, approximate time, and what you clicked. A screenshot can help an IT or fraud team, but do not click the message again to obtain one. If the page downloaded anything automatically, treat the incident as a possible download and follow the malware steps below.
If you entered a password or verification code
Assume the entered credential is exposed. Microsoft Support’s phishing-response guidance states: “Immediately change the passwords on all affected accounts, and anywhere else that you might use the same password.” Make the changes by navigating directly to the real service, preferably from a trusted device.
Secure the account in this order
- Change the affected password. Use the service’s official settings or account-recovery page. Create a long, unique password that you have not used elsewhere.
- Replace every reused copy. If that password was used for email, social media, shopping, cloud storage, or another account, change each one through its genuine site or app. Start with your primary email because it can be used to reset other accounts.
- Turn on multi-factor authentication. Enable MFA wherever the service offers it. A physical security key is an optional, compatible MFA method; it strengthens future sign-ins but does not remove malware or repair an account that was already taken over.
- Inspect recent activity. Review sign-in history, active sessions, sent messages, connected applications, forwarding rules, and recovery email addresses or phone numbers. Remove changes you did not make.
- End other sessions. Use the service’s “sign out of all devices” or equivalent control after you regain control.
- Warn your contacts if necessary. If the account sent messages you did not write, tell contacts through another channel not to open them.
When you cannot sign in
Use only the provider’s official account-recovery process. Reach it by typing the provider’s known address or using its official app, not by following a recovery link in the phishing message. Be ready to identify the information you shared and the time of the incident so the provider can investigate.
If you gave a scammer bank, card, or identity information
Contact the bank, card issuer, or other financial institution promptly. Use the telephone number on the back of the card, on a statement, or on the institution’s official website. Explain exactly what you disclosed and when. The institution can tell you whether to cancel a card, replace an account number, monitor transactions, or take another protective step; do not assume a particular reimbursement or recovery result.
Identity information requires a separate response
If you disclosed a Social Security number, bank-account details, credit-card data, or other personal information and identity theft is suspected, use IdentityTheft.gov. The Federal Trade Commission directs consumers there for steps tailored to the information lost. Keep a record of the institutions you contacted, case numbers, dates, and any unauthorized transactions.
Do not wait for a fraudulent charge
Review account alerts and statements for activity you did not initiate, but do not delay the initial call while waiting for a charge. Tell the institution about the phishing event even if no transaction has appeared yet. Continue using only the institution’s verified channels for follow-up.
If a file downloaded or an attachment opened
A download or installation creates a device-risk problem in addition to any account risk. Stop signing in to email, banking, payment, or other sensitive services on the potentially affected device until it has been checked. If you already used those services there, secure the accounts from a different trusted device.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallScan and clean the device
- Disconnect the device from the internet if you believe it is infected or if it is connected to a work network. For a business computer, follow the organization’s isolation procedure rather than improvising.
- Update the security software you trust and run a full scan. Apply the software’s removal or quarantine action for anything it identifies.
- Install operating-system and application updates from their normal settings or official sources.
- Do not reinstall the downloaded program, reopen the attachment, or disable security warnings to make it run.
- If the scan cannot resolve the problem, contact the device manufacturer or a trusted technical-support provider. For an organization-owned device, let IT handle remediation.
The FTC’s malware guidance, identified as April 2025, supports updating trusted security software and scanning when malware may have downloaded. A scan result is not a reason to declare an account safe: continue the account-security steps if credentials or financial information were also entered.
If the message involved work or school
Notify your organization’s IT, security, or help-desk contact immediately when a work or school account, computer, phone, or shared file was involved. Use the internal reporting route even if you believe you only clicked. Tell them the message source, the link or attachment involved, whether you entered credentials, what device you used, and any actions you already took.
Do not delete organizational evidence before IT advises you. The team may need message headers, the original attachment, browser details, or endpoint logs. If the device is believed infected, FTC small-business guidance advises disconnecting it from the network and notifying IT. Follow your organization’s containment, password-reset, and notification procedures rather than using personal accounts to continue investigating.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Report the phishing attempt, then remove it
Reporting can help providers and investigators identify campaigns, but reporting does not replace password, financial, or malware response.
- Forward a phishing email to reportphishing@apwg.org.
- Forward a phishing text message to 7726 (SPAM).
- Report the fraud attempt to ReportFraud.ftc.gov.
- For a work or school incident, submit it through the organization’s reporting route as well.
After you have reported it and preserved any details your IT or financial institution needs, delete the message. Emptying the trash is optional until the relevant team confirms it no longer needs the evidence.
Best Value
Common mistakes that make the damage worse
- Continuing the conversation: A follow-up message may pressure you to “verify” information or install remote-support software. Stop responding.
- Using the message’s recovery link: A password-reset page inside the same message can be another credential trap. Open the service independently.
- Changing only one reused password: Every account sharing that password remains exposed until it has a unique replacement.
- Logging in from a questionable device: If malware may be present, use a trusted device for account recovery and financial calls.
- Assuming MFA cancels the incident: MFA reduces future unauthorized sign-ins, but an attacker may already have a session, recovery method, or stolen code. Review active sessions and recovery details.
- Delaying an IT or bank notification: Early notice gives those teams more options for containment and transaction monitoring.
Hardening accounts after the incident
Once the immediate response is complete, make future phishing attempts less useful. Use a different long password for every account; a password manager can help generate and store unique credentials. Keep MFA enabled, and consider a compatible physical security key for accounts that support it. CISA’s phishing guidance identifies MFA and password managers as account-hardening measures, but neither substitutes for cleaning a potentially infected device or reporting a takeover.
Review recovery email addresses and phone numbers periodically, remove old devices and third-party app connections, and enable transaction and sign-in alerts where available. These controls are most useful when configured through the account’s genuine settings rather than through a link in an unsolicited message.
What to document while you recover
Maintain a short incident record: the message’s sender and subject, the time you clicked, information entered, files opened, devices used, password changes, account-recovery case numbers, financial-institution contacts, scan results, and reports submitted. This prevents conflicting information when several teams are helping and gives investigators a timeline without requiring you to revisit the phishing page.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesThe safest general rule is simple: stop using the suspicious message as your source of truth. Verify independently, then match the response to the information or access that may have been exposed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
