Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Act according to what you exposed. Closing a suspicious page after clicking it is different from entering a password, giving someone a one-time code, submitting bank details, or downloading a file. Stop communicating through the message, use a known-good route to the real service, and follow the matching response below. A click alone does not prove that an account was taken over, but a disclosed password or verification code should be treated as a possible compromise.
First, identify what happened
Write down the furthest point you reached without reopening the message. The response depends on both the information exposed and any consequence you can already see.
| What happened | What it means | First priority |
|---|---|---|
| Opened a link and entered nothing | The page may have tried to collect information or deliver a download, but the click alone does not establish account takeover. | Close it, verify the supposed issue through the real app or a known address, and check whether a file downloaded. |
| Entered a password | The attacker may be able to sign in, especially if that password was reused. | Change it at the genuine service, change reused copies, revoke other sessions, and check recovery settings. |
| Shared a verification code or approved a sign-in prompt | The code may have completed an attacker’s login or allowed an account change. | Secure the account independently, review sessions and recovery details, and contact official support if control is uncertain. |
| Entered card, bank, Social Security, or other identity data | Payment fraud, account access, or identity theft may follow. | Contact the financial institution or card issuer through a verified route and use IdentityTheft.gov for identity-information exposure. |
| Downloaded or installed a file | The device may have unwanted or harmful software; a download is not proof that malware ran. | Stop using the file, update legitimate security software, run a scan, and follow its remediation instructions. |
Do these steps immediately in every case
- Stop the conversation. Do not reply, pay, sign in again, enter another code, or approve another prompt from the suspicious email, text, call, or page.
- Close the suspicious page. Do not revisit the link to retrieve details. If you need the message for reporting, preserve it in the inbox or take a safe screenshot without clicking anything in it.
- Reach the real organization independently. Open its official app, type an address you already know is correct, or call a number from a statement, card, or prior official correspondence. Never use a phone number, button, or “support” address supplied by the suspicious message.
- Record useful facts. Keep the sender information, message, transaction records, and approximate times if doing so is safe. These details help the service, your bank, and investigators reconstruct events.
If you only opened the link
Close the page and do not sign in, pay, reply, or approve anything there. Check the alleged problem through the organization’s genuine app or a known address. Look at the browser’s download history and your device’s recent files. If nothing was entered and no file was downloaded or installed, move to monitoring rather than assuming that the account is compromised.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteA page can still be dangerous if it prompted a download or software installation. In that situation, use the device-scan steps below. Do not install a “cleanup” tool recommended by the same message or pop-up.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you entered a password
Use a separate, known-good device if you suspect the first one is infected, then navigate independently to the genuine service.
- Change the exposed password immediately. Do not reuse the password you are replacing.
- Change that password anywhere else you used it. Attackers routinely test one stolen password against email, shopping, social, and financial accounts.
- Sign out other devices and sessions using the service’s account-security controls. If the service offers “sign out everywhere,” use it.
- Check the recovery email addresses and phone numbers. Remove anything you do not recognize and restore your own details.
- Review recent sign-ins, sent messages, profile changes, forwarding rules, and connected applications. Undo changes you did not make.
- Turn on multifactor authentication (MFA) using an option the service supports. A security key is one possible MFA credential, but it cannot undo a password disclosure or restore an account that has already been taken over.
Prioritize email accounts. Someone with access to your email may be able to reset passwords for other services. After securing email, work through accounts that share the exposed password or contain financial, work, or identity information.
If you shared a verification code or approved a sign-in request
Treat the account connected to that code as potentially exposed even if you do not yet see a change. The FBI’s consumer guidance is explicit: “Never share this code with anyone.” A legitimate support representative, bank employee, or service will not need you to read an authentication code to prove who you are.
- Stop responding to the requester and do not provide another code.
- Open the service’s genuine app or type its known address yourself. Do not use a link in the conversation.
- Change the account password and revoke other active sessions or devices.
- Inspect recovery email addresses, phone numbers, MFA methods, forwarding rules, and connected apps for changes.
- Review security alerts and account activity for logins, messages, purchases, or settings you did not authorize.
- Contact the service through its official support channel if you cannot sign in, see altered recovery details, or suspect the attacker still has access.
If the code came from a financial institution or a transfer is involved, call the institution immediately through its verified app or a number you already trust. Ask it to secure the account and investigate or stop the transaction. The FBI also recommends reporting fraudulent internet transfers to the Internet Crime Complaint Center (IC3.gov).
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you entered card, bank, Social Security, or other identity information
Payment cards and bank accounts
Contact the card issuer or financial institution promptly using the number on the card, a statement, or the institution’s official app. Explain exactly what you submitted and when. Ask what account protections, card replacement, transfer recall, or payment dispute steps apply. Review transactions and account changes for anything you did not make, and continue checking after the initial call.
Social Security and identity information
For a Social Security number or other identity information, use IdentityTheft.gov. The Federal Trade Commission’s recovery process provides a plan based on the information disclosed and the signs of misuse. Keep any case records and follow the agencies’ current instructions.
Do not send additional identity documents to the original message or to an unsolicited “recovery” service. Scammers often follow an initial disclosure with an offer to fix the problem.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsIf a file downloaded or software may have installed
- Stop opening the downloaded file and disconnect from sensitive online activity. Do not enter more passwords or payment details on that device until it has been checked.
- For a work-managed device, notify your organization’s IT or security team promptly and follow its incident process. Do not delete evidence or install unapproved tools unless the team directs you.
- Update legitimate security software and its detection data, then run a full scan. Follow the software’s remediation instructions for anything it identifies.
- Apply pending operating-system and browser updates after your organization’s process allows it. Restart if the security software requests a reboot and run any recommended second scan.
- From a device you trust, change passwords that may have been entered on the suspect device and review those accounts for unauthorized activity.
These steps address the possibility of harmful software; they do not mean that every phishing click installed malware. If the device shows persistent pop-ups, unknown applications, disabled security tools, unusual accounts, or unexplained network activity, obtain professional or organizational incident-response help.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Secure the account and look for signs of takeover
After changing credentials or responding to a code disclosure, use the service’s current security page to check:
- Active sessions, remembered devices, and recent sign-ins
- Recovery email addresses and phone numbers
- MFA methods, backup codes, and authentication-app entries
- Email forwarding rules, filters, delegated access, and sent or deleted messages
- Connected applications, browser extensions, and third-party permissions
- Profile, shipping, payment, or security-setting changes
Remove unfamiliar entries, save evidence of suspicious activity, and repeat the review after a few days. Session-revocation controls differ by service, so follow that provider’s current official instructions rather than assuming every account has the same menu.
Report the phishing attempt and preserve evidence
In the United States, the FTC advises:
- Forward phishing emails to reportphishing@apwg.org.
- Forward phishing texts to SPAM (7726).
- Report the attempt at ReportFraud.ftc.gov.
Report internet crime to IC3.gov. If money was transferred fraudulently, contact the financial institution first and make the IC3 report promptly. Keep the original message, sender details, relevant screenshots, transaction records, and approximate timeline where safe. Do not click the message again just to collect information.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What not to do
- Do not call a number or use a website address supplied by the suspicious message.
- Do not send a second verification code because someone claims the first one “failed.”
- Do not assume that a familiar logo, caller ID, or email address proves identity.
- Do not pay an unsolicited person who promises to recover your account or refund a loss.
- Do not delete a work-device message or wipe the device before your IT or security team advises you.
- Do not claim that a click automatically installed malware or that an account is safe merely because no alert appeared.
After the incident: prevent a repeat
Use a password that is unique to each important account and store it in a reputable password manager. Keep MFA enabled and consider a compatible physical security key for services that support one. Verify every unexpected request through a known-good route, and remember that an authentication code is secret authentication material, not proof that a caller is legitimate.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep operating systems, browsers, and security software updated. Learn where each provider shows active sessions and recovery settings before an emergency. For work accounts and devices, follow the organization’s phishing-reporting and incident-response procedure even if you believe no information was entered.
If you cannot regain control
Use the affected service’s official account-recovery process from a known address and contact its official support team. Tell support that a password or authentication code may have been disclosed and provide the approximate time, altered recovery details, and suspicious activity you observed. Secure your email first when possible, because it may control recovery for other accounts. For financial exposure, keep working directly with the institution’s fraud team; for identity exposure, follow the tailored plan at IdentityTheft.gov.
Guidance outside the United States
The FTC reporting addresses, IdentityTheft.gov, and IC3 are U.S.-focused resources. Elsewhere, contact the affected service and financial institution through verified channels and use your country’s official cybercrime and consumer-protection reporting services. Account-recovery menus, deadlines, and fraud protections vary by provider and jurisdiction, so use the current instructions for your service and location.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
