What to do right after you click a suspicious link: fast, safe steps for beginners

Clicking a suspicious link can be unsettling, but clear, ordered action greatly reduces the chance of theft or malware. Do the following now, then follow the longer checks below. Work from a different, trusted device whenever possible.

Immediate actions (first 5–15 minutes)

1. Stop interacting with the page. Do not enter any credentials, codes, or personal information. Do not call numbers or click follow-up links the page shows.
2. Disconnect from the network. Turn off Wi‑Fi and mobile data, or unplug Ethernet. This prevents the page or any downloaded program from communicating outward.
3. Close the tab or app. If it won’t close normally, force‑quit the browser or app. If a download began and is still in progress, do not restart the device yet—note the file name and location for later analysis.
4. Use a different device to act next. Use a phone, tablet, or computer you trust when changing passwords or contacting banks. If you cannot access another device, proceed with caution (see "If you must use the same device").
5. Record what happened. Note the URL, sender (email/number), time, and any file name or dialog shown. This information is useful for IT, your bank, or reports to the service provider.

If the page asked for login info or 2FA codes

• Assume the credentials were captured. From a clean device, immediately change the password for that account and any other account using the same password.
• Sign out active sessions. In the account’s security settings, sign out all devices or revoke sessions/tokens if available. That helps stop attackers who already signed in.
• Check account settings for tampering. Look for unauthorized email forwarding, recovery phone numbers, alternate emails, linked apps, or new payment methods and remove them.
• Reset 2FA if needed. If you used SMS-based 2FA and suspect the attacker controls your phone number, contact the provider to secure or move the number. Prefer authenticator apps or hardware tokens where available.

If a file downloaded or an app started installing

• Do not open the file. Delete unexpected downloads from your Downloads folder if you can do so safely after disconnecting. If unsure, keep a note of the file name and location.
• Boot to safe mode or offline mode before investigating. On many systems, safe or diagnostic modes limit what third‑party software can run. If you are not comfortable with these steps, skip to getting professional help.
• Look for new programs or browser extensions. On a trusted device or in safe mode, check installed apps and browser extensions for anything you didn’t add and remove suspicious items.

Scan, clean, and update the device

• Run a full malware scan. Use reputable antivirus/anti‑malware software and update its definitions first. Built‑in protection on most modern systems can run a full scan; if it finds threats, follow its recommended removal steps.
• Follow up with a second scanner if you’re worried. Running a different reputable scanner can catch items the first might miss. Use these only on the affected device after disconnecting or in safe mode.
• Install pending system and browser updates. Updates close vulnerabilities attackers exploit. Apply OS and browser updates before reconnecting to the internet when possible.
• Back up important files before making major changes. If you plan a factory reset or deeper cleanup, back up necessary documents to external media you control. Warning: some resets will remove apps and settings—review what will be lost before continuing.

Secure accounts and monitor for fraud

• Change passwords from a clean device. Start with your email, financial services, and any accounts where you used the same password. Use strong, unique passwords; consider a password manager to generate and store them.
• Review financial statements and recent activity. Check bank and card accounts for unauthorized charges and notify your bank immediately if you see anything suspicious.
• Watch for phishing follow-ups. Scammers often send follow-up messages or calls. Do not provide details by phone or message unless you independently verify the contact.
• Consider additional protections. For serious exposures, consider placing a fraud alert on your credit report or freezing your credit (procedures depend on your country).

When to get help and how to report it

• Contact IT immediately for work devices or accounts. Company systems may require coordinated response to protect others and preserve logs for investigation.
• Seek professional help if malware persists. If scans don’t remove threats, you see recurring strange behavior, or you lack confidence in restoring the device, consult a trusted local technician or the device manufacturer’s support.
• Report phishing or fraud to the service provider. In email, mark messages as phishing; on social platforms, report the post or account. Report financial fraud to your bank and local authorities if money was lost.
• Provide useful information when reporting. Include the suspicious URL, email headers or screenshots, sender details, timestamps, and any file names. These help investigators block the attack and protect others.

What can go wrong: avoid changing passwords on a device you suspect is compromised; don’t delete evidence before recording file names if you’ll report the incident; do not plug unknown USB drives into other machines. Acting calmly and following these prioritized steps greatly reduces harm and helps you recover more quickly.