Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
First, find out what happened after the click: did they only view the page, enter information, download or open a file, approve a sign-in prompt, or share a verification code? Close the page, stop using the message, and follow the response that matches the exposure. A click alone does not prove that a device or account was compromised.
Start with a calm, 10-minute triage
Keep the message and any screenshots for reference, but do not click the link again, reply, call a number in the message, or install software it offers. Ask the family member these questions:
- What happened immediately after the link opened?
- Did they type a username, password, card number, bank detail, Social Security number, or other personal information?
- Did they download or open a file?
- Did they approve a sign-in notification, scan a QR code, or provide a one-time verification code?
- Did the device show redirects, pop-ups, new software, warnings, or other unusual behavior?
- Are there account alerts, password-reset messages, or transactions the person does not recognize?
Use a phone, tablet, or computer you believe is safe to contact the real company. Type the company’s known address yourself or use a saved bookmark. Do not use contact details supplied in the suspicious message. This is the FTC’s recommended way to verify an account or report a problem.
What if they clicked but did not enter anything?
Close the page and do not revisit it. If no information was entered, no file was downloaded or opened, no prompt or code was approved, and there are no device symptoms or account alerts, the click by itself does not establish an infection or account takeover. Keep the operating system, browser, and security software current, and watch the relevant accounts for activity the user did not authorize.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
That does not mean every link is harmless. A phishing page can request information or lead to malware, so continue checking what happened after the initial click. The FTC does not give a numerical probability that a click will infect a device; do not rely on an invented percentage.
What if they entered a password or username?
From a device the family member believes is safe, go directly to the real service and change the password. If the same password was used elsewhere, change it on every other account, starting with email. An email account deserves priority because its password-reset messages can provide a route into other services.
- Open the provider’s address by typing it or using a trusted bookmark, not the phishing link.
- Change the exposed password to a new, unique one.
- Use the provider’s official recovery process if the password no longer works or the account is locked.
- After regaining access, sign out other devices and sessions.
- Check the recovery email addresses and phone numbers and remove changes the user did not make.
- Review email-forwarding rules, filters, recent sign-ins, and sent messages for unauthorized changes.
- Turn on multifactor authentication (MFA) if the service offers it.
- Warn contacts if the account sent messages, links, or money requests that the user did not create.
These account-recovery checks follow the FTC’s guidance for a hacked email or social-media account: review the provider’s recovery and security steps. If the person cannot regain access, use only the provider’s official support or recovery channel; do not pay a stranger who contacts the family offering to recover the account.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat if they shared card, bank, Social Security, or identity information?
Contact the bank, card issuer, employer, government agency, or other relevant organization through a telephone number or website already known to be genuine. Explain exactly what was disclosed and when. Ask what protective action that institution wants taken; the remedy depends on both the type of information and the institution involved.
For U.S. exposure of Social Security, bank, or card information, the FTC directs consumers to IdentityTheft.gov. Its recovery plan is tailored to the information lost. Do not assume that every disclosure requires the same account closure, replacement, or monitoring step.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When speaking with a financial institution, use the number on the back of a card, a statement, or the institution’s official website—not a number in the phishing email, text, or pop-up. Keep confirmation numbers and notes about the call so the family member can track what was reported.
What if a file was downloaded or opened?
A downloaded or opened file changes the response because malware may have been introduced. Stop signing in to banking, shopping, email, and other sensitive accounts on that device until it has been checked. If possible, use a different, trusted device to change exposed passwords and contact financial institutions.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsUpdate the device’s legitimate security software, run a scan, and remove anything it identifies as a problem. The FTC states: “If you think you clicked on a link or opened an attachment that downloaded harmful software, update your computer’s security software.” It then advises: “Then run a scan and remove anything it identifies as a problem.” See the FTC malware guidance for the consumer-level process.
Possible warning signs include browser redirects the user did not request, new toolbars, repeated system errors, disabled security tools, or messages sent from the account that the user did not write. These signs justify investigation; they are not conclusive proof of malware.
If symptoms continue after updating and scanning, contact the device maker, a support company the family already trusts, or a knowledgeable technician. Never call a number displayed in a pop-up and never grant remote access to an unsolicited caller. The exact cleanup steps depend on the operating system, device, and software involved.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What if they approved a sign-in prompt or shared a one-time code?
Treat an approved prompt or shared verification code as an account-security event even if no password was typed. Go to the real provider immediately, change the password, end other sessions, and review recovery details and recent activity. Remove unfamiliar devices or authentication methods and enable MFA again using the provider’s official settings.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Tell the provider exactly what happened: whether the family member approved a notification, entered a code on a web page, read a code to a caller, or scanned a QR code. That detail helps the provider determine which sessions or credentials must be revoked. Do not approve additional prompts while investigating.
What if they can no longer access email or social media?
Use the service’s official account-recovery instructions. If a device download or unusual behavior also occurred, update security software and scan before entering a new password on that device.
Indicators of a takeover include an unrecognized login, a username or password change the user did not make, inability to sign in, or friends receiving messages the person did not send. After control is restored, complete the security checks above and notify contacts not to click unexpected links or respond to requests for money.
Secure email especially carefully. Someone who controls an email inbox may be able to reset passwords for other accounts, even when those accounts were not part of the original phishing message.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to report the phishing message in the United States
After preserving any details needed for account or financial recovery, report and delete the message. The FTC’s U.S. reporting routes are:
- Forward phishing email to reportphishing@apwg.org.
- Forward suspicious text messages to 7726 (SPAM).
- Report the attempt at ReportFraud.ftc.gov.
- For exposed identity or financial information, use IdentityTheft.gov for a recovery plan.
These channels are U.S.-specific. In another country, use the national fraud-reporting service, the financial institution’s fraud team, and the affected provider’s official support route. Reporting does not replace changing passwords, contacting a bank, or scanning a device.
Email was the top method scammers used to contact people in 2024, according to an FTC consumer alert published in April 2025: FTC phishing alert. The alert gives that ranking but no count or percentage in the cited passage.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can clicking a phishing link infect a phone?
It can expose a person to a malware download or a deceptive request, but clicking alone is not proof that the phone is infected. The important distinctions are what happened after the page opened, whether a file was downloaded or launched, and whether the phone now shows symptoms. Apply the same triage: close the page, avoid further interaction, keep the phone’s operating system and security features current, and investigate any unexplained redirects, apps, messages, or account activity.
Recommended Free Tools
Do not install a “cleaner,” antivirus app, or remote-support tool offered by the page or a caller who references it. Use the phone maker’s built-in settings and official support information. If the phone continues behaving strangely, obtain help through a trusted support route rather than the suspicious message.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Prevent a repeat incident
Use unique passwords
A password entered on one phishing page should not unlock another account. Use a different password for every important service, particularly email, banking, cloud storage, and social media. Change reused passwords after an exposure, even when there is no sign of unauthorized activity.
Turn on MFA
MFA makes access harder when a scammer has only a password. Available methods vary by account and may include an authenticator code, a text or email code, biometrics, or a physical security key. The FTC identifies a security key as one possible credential. A FIDO-compatible key can be considered for an account that explicitly supports security-key MFA, but check compatibility and recovery options first; it is optional protection, not an emergency purchase for someone who merely clicked.
Keep software and backups current
Install operating-system, browser, and security updates from the device’s normal settings. Keep backups of important files so a device problem does not become permanent data loss. Updates and backups reduce the impact of future incidents but do not undo information already submitted to a scammer.
Adopt a family verification habit
Agree that unexpected requests for passwords, payment, urgent transfers, or verification codes will be checked through a separate, known contact method. A family member can call the organization using a saved number or open its app directly instead of following a message link. This pause is especially useful when a message claims an account will be closed or a payment is overdue.
When to get professional help
Seek trusted technical help when malware symptoms persist, the person cannot regain an account, multiple accounts show unauthorized changes, or financial or identity information was exposed and the institution requests additional action. Choose the device maker, account provider, bank, or an established support professional reached through contact details you independently verify. Do not allow an unsolicited caller or pop-up operator to control the device.
The appropriate recovery path depends on the device, operating system, account provider, country, and information disclosed. When in doubt, preserve evidence, stop further interaction with the phishing message, and use a known-good route to the organization that controls the affected account or money.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →
