iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Stop interacting with the page, do not enter anything else, and do not call numbers shown in the message or pop-up. A click alone does not prove that your device is infected. Your response depends on what happened next: whether you entered credentials or financial information, downloaded or ran a file, and whether the device now behaves unusually. Preserve the message and URL, secure any exposed accounts through trusted channels, scan a potentially affected device, and report the scam to the organization that can act on that type of exposure.
Take these steps immediately
- Close or leave the suspicious page. Do not type a password, card number, one-time code, Social Security number, or other personal data. Do not install an app, browser extension, remote-access tool, or “security” update offered by the page.
- Ignore instructions displayed by the message or pop-up. Scammers may show a phone number, ask you to keep the incident secret, or tell you to call technical support. Use a number from your card, statement, official app, or a bookmark instead.
- Record what happened. Save the original email or text if possible, and note the sender, exact URL, date and time, device, what you clicked, and anything you entered or downloaded. Microsoft recommends documenting attack details while they are fresh.
- Classify the exposure. The correct recovery path is different for a harmless click, an exposed password, payment details, identity information, or a downloaded program.
Choose the recovery path by exposure
| What happened | Priority action | Where to get help |
|---|---|---|
| You opened the page but entered nothing, downloaded nothing, and see no symptoms | Close it, preserve the message and URL, update the device, and review the account or service through a trusted route for unexpected activity. | The service’s official support channel if an account was targeted; report the message through the appropriate abuse channel. |
| You entered a username, password, or one-time code | Treat the credential as exposed. Change it from the real service, make it unique, end other sessions, and turn on multifactor authentication. | The real service, reached through a known bookmark, official app, or manually typed address. |
| You entered card or bank information | Contact the issuer immediately, ask whether the account or card should be blocked or replaced, and monitor transactions. | The phone number on the card or a statement, not the message. |
| You entered a Social Security number or other identity data | Start an identity-theft recovery plan and follow its steps for fraud alerts, reports, and replacement documents. | IdentityTheft.gov. |
| A file downloaded, software ran, an extension installed, or the device acts strangely | Disconnect a networked computer, update legitimate security software, run a full scan, and remove what it identifies. | A trusted technical professional or your employer’s security team for a managed device. |
If you entered a password or one-time code
Assume the password is compromised even if the page looked authentic and nothing unusual has happened yet. Open the service independently: use a bookmark you created earlier, the service’s official mobile app, or an address you type yourself. Never return through the suspicious link.
- Change the password immediately.
- Choose a long, unique password that you do not use on any other site. If you reused it elsewhere, change those accounts too, beginning with email, banking, password managers, and cloud storage.
- Use the service’s account-security page to sign out other sessions, revoke unfamiliar devices or app tokens, and remove unknown recovery addresses or phone numbers.
- Enable multifactor authentication. An authenticator app or a hardware security key provides a separate possession factor; text messages are better than no MFA but can be vulnerable to number takeover.
- Check recent sign-ins, sent messages, forwarding rules, payment methods, and profile changes. Remove anything you did not authorize and tell contacts if your account sent scam messages.
A one-time code is not harmless. Entering it can let an attacker complete a login or reset while you are looking at the fake page, so secure the account even if you supplied only the code and not the password.
If you entered card or bank details
Call the bank or card issuer using the number printed on the card or shown on a statement. Explain that the information was entered on a suspected phishing page. Ask whether the card or account should be blocked, replaced, or placed under additional monitoring. Follow the issuer’s instructions for disputing transactions; do not wait for a charge to appear before reporting the exposure.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Review transactions and account alerts frequently. Change online-banking credentials through the bank’s real app or typed address, and check whether the scammer changed contact details, beneficiaries, payment recipients, or transfer limits. Keep the incident record and the issuer’s case number.
If you disclosed identity information
If the page collected a Social Security number, driver’s-license details, tax information, or a combination of personal identifiers, use IdentityTheft.gov to obtain a recovery plan. The Federal Trade Commission’s 2024 consumer alert says: “If you think you’ve given someone your Social Security, credit card, or bank account number, report it at IdentityTheft.gov and get a recovery plan.” Complete the steps it gives you, which can include contacting affected organizations, placing fraud alerts or freezes, and replacing compromised documents.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use a trusted device when starting the recovery process if the original device may have malware. Keep copies of reports, confirmation numbers, and correspondence in a secure location.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →If something downloaded, installed, or ran
A download is more serious than merely viewing a page, especially if you opened the file, granted permissions, or installed an extension. On a computer connected to a home or business network, turn off Wi‑Fi or unplug Ethernet while it is assessed. The FTC’s small-business cybersecurity guidance recommends disconnecting an affected networked computer to limit spread.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Do not open the downloaded file again or follow the page’s instructions to “clean” the device.
- From a trusted source, update the legitimate security software already on the device.
- Run a full system scan, not only a quick scan, and quarantine or remove anything it identifies.
- Review installed applications, browser extensions, startup items, and notification permissions; remove only items you can identify as unwanted, or ask a trusted technician.
- Change important passwords from a different, clean device after the scan, because malware could capture new keystrokes.
- If symptoms continue, back up essential personal files without copying unknown programs and obtain professional help. A work device should be handled by the employer’s IT or security team.
Warning signs include new pop-ups, browser redirects, disabled security tools, unknown apps or extensions, unusual battery or network use, files being renamed, or account activity you did not perform. Their absence does not prove that a file was safe, and their presence does not identify the exact malware; scanning and expert assessment do.
Personal device versus employer-managed device
Personal phone or computer
Disconnect only when there is a download, execution, or suspicious behavior that could spread over a network. Keep notes, update the operating system and security tools, and scan as described above. Contact the bank, service provider, or identity-recovery channel yourself through trusted contact details.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Employer-owned or managed device
Tell your help desk or security team promptly, including the original message, URL, time, and actions taken. Do not erase logs, uninstall corporate tools, or continue experimenting on the device. Follow the organization’s incident process; administrators may need to isolate the device, reset credentials centrally, or check other accounts and endpoints.
Report the scam through the right channel
- Suspicious text messages: forward the message to SPAM (7726) when your carrier supports that short code.
- Phishing email: send it to ReportPhishing@apwg.org. Preserve the original message if the reporting channel requests full headers.
- Fraud or financial loss: file a report at ReportFraud.ftc.gov.
- Compromised account: use the service’s official “report hacked” or abuse process reached independently, not through the suspicious message.
- Work account or device: notify your employer’s security or IT team even if you believe the click was harmless.
Reporting does not replace changing a password, calling the bank, or scanning a device. It gives carriers, platforms, and investigators information they can use to block related campaigns.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
How AI changes scam detection
Generative AI can produce fluent prose, convincing branding, realistic replies, and polished translations at scale. CISA notes that “a common sign used to be poor grammar or misspellings although in the era of artificial intelligence (AI) some emails will now have perfect grammar and spelling.” Good writing is therefore not evidence that a message is genuine.
Give more weight to the request and the route than to grammar. Be cautious when a message creates urgency, claims an account or payment problem, asks for a password or one-time code, requests an unusual transfer, or uses a domain that does not exactly match the organization. Hover over links on a computer to inspect the destination, but do not visit a suspicious destination merely to check it. Verify by opening the organization’s known app or website yourself, or by calling a number from a card, statement, or previously trusted contact record.
Signals that deserve independent verification
- An unexpected invoice, delivery notice, refund, payroll change, or account suspension.
- A request to bypass normal approval, keep a transaction secret, or act before a stated deadline.
- A look-alike domain, shortened URL, unusual spelling in the address, or a link whose visible text differs from its destination.
- A request for credentials, MFA codes, gift cards, cryptocurrency, remote access, or an “urgent” software installation.
- A familiar person’s writing style paired with a new address, changed payment instructions, or a request that does not fit the usual conversation.
Common mistakes after a click
- Logging in again through the same link: this can expose the replacement password too. Use an independently opened service.
- Calling the pop-up number: fake support agents may request remote access or payment. Use a card, statement, official app, or typed website for contact details.
- Assuming no symptoms means no risk: stolen credentials and payment data can be abused later. Secure exposed accounts now.
- Deleting the message immediately: preserving the sender, URL, headers, and timestamp helps your provider, employer, and investigators.
- Installing a second “cleaner” offered by the scam: only use security software obtained through a source you already trust.
- Waiting to report a financial exposure: early contact gives the issuer more options to block or replace an account.
Prevent the next successful phish
Use unique passwords stored in a reputable password manager and enable multifactor authentication on email, financial, cloud, and social accounts. A FIDO2-compatible security key can provide a phishing-resistant possession factor because it verifies the legitimate website before responding. Keep operating systems, browsers, apps, and security software updated, and back up important files so a compromised device can be rebuilt without paying an attacker.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For workplaces, establish a second-channel verification rule for payment or account changes, train staff that polished language is not proof, and make reporting a routine, non-punitive action. Individuals can apply the same rule: pause an unexpected request, open the service independently, and verify the sender through a contact method already on file.
Quick Recap
What to remember
- A click by itself cannot tell you whether malware was installed; exposure and symptoms determine the response.
- Any password or one-time code entered on a suspicious page should be treated as exposed.
- Downloaded files, installed extensions, and strange behavior justify a legitimate full scan and, when appropriate, network disconnection.
- Banks, IdentityTheft.gov, your employer, SPAM (7726), APWG, and ReportFraud.ftc.gov handle different parts of recovery.
- AI-generated polish makes verification more important, not less.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
