Clicked a Link in a Scam Text? What to Do Now

What to Do If You Clicked a Scam Link: The First Five Minutes

Start by slowing down. Scam texts are written to rush you, and a rushed second mistake, such as typing a code or pressing a button on the fake page to "cancel" something, does more harm than the first tap. The next few minutes are about ending contact with the page and working out what, if anything, left your phone.

The table sorts the common outcomes by urgency. If more than one row applies, for example you entered a password and then a code, deal with the most urgent row first.

One reassurance before the details: official advice for this situation is practical, not alarming. The FTC's guide to recognizing and avoiding phishing tells anyone who thinks a scammer has their Social Security, credit card, or bank account number to go to IdentityTheft.gov, where the steps are matched to the information that was lost. In other words, the response depends on what you gave away, not on the fact that you tapped. The rest of this guide follows the same logic.

What a Scam Link Can and Can't Do to Your Phone

A link in a text is an instruction to open something. CISA's guidance on social engineering describes smishing messages with links that, when tapped, may automatically open a browser window, start an email, or dial a number. Most scam links open a web page, and that page is where the scam actually happens.

Behind the tap, a few things usually occur. The link may bounce through one or more redirects before it lands, which makes it harder for filters to block and harder for you to see the final address; CISA also notes that criminals may use a URL shortening service to hide where a link really goes. The site receives what any website receives: your IP address, which points to a rough area and your internet provider, plus your phone model and browser version. And the string of characters at the end of a scam link is sometimes unique to each recipient, so the sender can match the visit to your phone number and note that you're someone who opens links.

Example scam text

+1 (415) 555-0163

Text Message

Security notice: a sign-in to your account from a new device was blocked. If this was not you, verify your identity within 2 hours to avoid suspension: account-review.example/secure

What the page wants from you comes from a short menu. The FTC's list of common phishing tactics includes messages that claim suspicious activity or log-in attempts, a problem with your account or payment information, a need to confirm personal or financial details, or a link to make a payment. Behind those stories sit a handful of goals:

• Your login. A copy of a real sign-in page for a bank, email provider, or streaming service, waiting for your username and password.
• Your card. A checkout page for a renewal, an overdue bill, a redelivery fee, or a refund "processing" charge.
• A code. A box asking for the verification code "we just sent you," which is really a code a legitimate company sent because the scammer triggered it.
• An install. A prompt to download an app, add a profile, subscribe to a calendar, or allow notifications.
• A conversation. A phone number for the "fraud team" or "support desk," which connects you to the scammer.

Now the reassuring part. A modern phone keeps websites inside the browser, where they can't read your texts, open your photos, or install apps by themselves. Attacks that take over a phone as soon as a page loads do exist, but they depend on unpatched software flaws, are expensive to build, and have mostly been aimed at particular people such as journalists, activists, and officials rather than everyone who receives a mass text. Updates close those flaws. The FTC's advice on protecting your phone from hackers says operating system updates often include critical patches and protections against security threats, and recommends setting your phone to update automatically.

So for most people, the realistic question isn't whether the tap infected the phone. It's whether you gave the page anything: a password, a card, a code, or permission to install something. The next five sections take those one at a time.

If You Clicked but Didn't Enter Anything

This is the most common outcome and the least harmful. If you clicked a spam link, looked at the page, and closed it without typing, the scammer has your visit and the basic details any website sees, but no password, card, or code. There's no need to change passwords or call your bank because of a tap alone.

Do three small things. First, make sure the page is really gone: close the tab, and if your browser restored it or lists it among recent tabs, close that as well. Second, update your phone's operating system and your browser. Third, think back over exactly what you pressed, because a few taps count as giving the page something even though you never typed:

• Autofill. If your browser offered to fill in your name, address, or a saved card and you accepted, treat that information as entered and follow the matching section below.
• Permission prompts. Allow notifications, Add to Calendar, Add to Home Screen, Download, and Install all leave something behind. The cleanup is covered in the sections on installs and phone settings.
• A file. If a download started, even one you never opened, delete it from your Downloads folder or the Files app.

Expect the tap to cost you something small: more spam. A click tells the sender your number is live and belongs to someone who opens links, which makes it more useful to them. Stay suspicious of unexpected messages for a while, especially any that mention the same company or problem as the first one. If you also replied to the message, our guide to what a reply to a scam text reveals explains what that adds.

If you can't remember what you tapped, don't guess in the optimistic direction. Run through the settings checks later in this guide; they take a few minutes and settle the question.

If You Typed a Password Into a Fake Login Page

Assume the password is already in use. Some fake login pages pass whatever you type to the real site on the spot, so a scammer can be signed in to your account before you've closed the tab. The order of steps matters: take control of the account first, then clean up.

The last step is the one people skip, and it's why a single fake page can open several accounts. CISA's advice for phishing victims is direct: immediately change any password you might have revealed, change it on every account where you used it, and don't use that password again. A working email-and-password pair can be tried automatically against many other sites, so a reused password spreads the damage quickly.

Why add a second factor if you've already changed the password? Because the next fake page might catch the new one. The FTC's phishing guide notes that multi-factor authentication makes it harder for scammers to log in even if they get your username and password. Text-message codes are better than nothing, but an authenticator app or a passkey holds up better. A passkey is tied to the real website's address, so a lookalike page has nothing to capture.

Which accounts to secure first

If you're not sure which password you typed, or the same one guards several accounts, work in this order:

1. Your email. Whoever controls your inbox can reset most of your other passwords.
2. Your Apple Account or Google Account. These hold your phone's backups, saved passwords, purchases, and the ability to locate or erase the device.
3. Banking and payment apps. Anything that can move money.
4. Your mobile carrier account. Access here can help someone move your number to a SIM they control.
5. Social media and messaging. Hijacked accounts are often used to scam your friends and family next.

If the scammer already changed the password and you're locked out, use the service's official account recovery process, reached through its app or a web address you type yourself. Ignore anyone who contacts you offering to recover the account for a fee. Real recovery runs through the company, not through a stranger who found you.

If it was a work account

A company login typed into a fake page is a security incident for your employer, not only for you. CISA's first step for victims is to report it to the appropriate people in the organization, including network administrators, so they can watch for suspicious activity. Tell your IT or security team right away, even if it feels embarrassing. They may be able to spot and block a sign-in that you can't see.

If You Entered Card or Bank Details

Card details typed into a fake payment page can be put to use almost immediately, so call before any charges show up. Use the phone number printed on the back of your card or listed in your bank's official app, never a number from the text or from the page you landed on.

When you reach your card issuer, explain exactly what happened and ask for three things:

• A block and a replacement. Canceling the card ends the stolen number's usefulness, and the new card comes with a different number.
• A review of recent and pending charges. Small charges sometimes come first, as a test of whether the card works.
• A check for phone wallets. Ask whether your card was recently added to Apple Pay, Google Wallet, or another wallet on a device that isn't yours, and ask them to remove it.

That last request matters because of how many of these pages work. After you submit your card, the fake site says your bank needs to verify the payment and asks for the code the bank just texted you. In many of these scams, that code has nothing to do with a payment. It's your bank checking whether to add your card to a mobile wallet on a phone the scammer holds. If you typed in a code like that, say so on the call. Depending on the bank, a wallet can keep working after the plastic card is replaced, so ask for any wallet you didn't set up to be removed specifically.

If it was a debit card, move even faster. Fraudulent debit transactions come straight out of your checking account, and getting that money back can take longer than disputing a credit card charge.

If you entered a bank login or account number

Online banking credentials are a password problem and a money problem at once. Change the password through the bank's official app, then contact its fraud department and ask them to review recent transfers, new payees, and any changes to your contact details. CISA's guidance for victims says to contact your financial institution immediately if you believe your accounts may be compromised, close any accounts that may have been, and watch for charges you can't explain.

If you gave your Social Security number or date of birth

Identity details can't be canceled like a card, so the goal shifts to making them harder to use. The FTC's guide to identity theft describes two free tools. A credit freeze, placed separately with Equifax, Experian, and TransUnion, stops anyone from opening a new credit account in your name while it's in place, and it's free to place and lift. A fraud alert, placed with any one of the three bureaus, tells businesses to check with you before opening a new account; it lasts a year, and the bureau you contact must tell the other two.

Then report what happened at IdentityTheft.gov, the FTC's site for identity theft reports and recovery plans. The reporting section below explains what the site gives you.

If you paid a small fee

Scam pages often ask for a tiny amount, because a small charge doesn't feel like much of a risk. The amount was never the point; the card number, expiration date, and security code you typed are. Handle it exactly like stolen card details: call the issuer, dispute the charge, and replace the card. Don't wait to see whether a larger charge appears.

If You Shared a Verification Code or Approved a Sign-In

A code typed into a scam page, or read aloud to someone the page connected you with, is often the most urgent situation of all. A real company sent that code because someone, almost certainly the scammer, started a sign-in, a password reset, a new device registration, or a payment at that moment. The code was the last barrier, and you may have just handed it over.

Start by rereading the text that delivered the code. It usually names the service and sometimes the action, such as signing in or adding a card to a wallet. Then act on that account:

• Bank or card codes. Call the number on your card, read them the message, and ask about new devices, new payees, and digital wallets.
• Email, Apple Account, or Google Account codes. Follow the password steps above, then review the list of signed-in devices and remove anything you don't recognize.
• Messaging app codes. Someone may be registering your number on their phone. Open the app on your own phone, register your number again, and turn on the app's PIN or two-step verification. Our breakdown of what someone can do with your phone number explains how these code requests work.
• Mobile carrier codes. Contact your carrier through the number on your bill or its official app. Ask whether a SIM change, eSIM transfer, or port-out request was made, and add a PIN or lock to your account.
• Google Voice codes. A scammer may be linking a new Google Voice number to your phone number. Our guide to Facebook Marketplace scams explains this version and where Google's help pages cover disconnecting your number.

The same logic applies if you tapped Approve or "Yes, it's me" on a sign-in prompt you weren't expecting. An approval does the job of a code. Change that account's password, sign out other sessions, and review its device list, just as you would after sharing a code.

If You Downloaded an App or Installed a Profile

This is the situation where the phone itself may be compromised, so clean the device before you use it to change passwords or check your bank. If you can, make account changes from a different phone or computer until you're confident this one is clean.

On Android

Android lets you install apps from outside Google Play, which has legitimate uses and is exploited by scammers. Scam pages coach people through it with a story: a tracking app for a parcel, a "security update," or a verification app from your bank. Once installed, a malicious app typically asks for powerful permissions, such as access to notifications or texts, which exposes your codes, or Accessibility access, which can let it read and control what's on your screen.

1. Cut its connection. Turn on airplane mode while you work, so the app can't send data out or receive instructions.
2. Uninstall it. Go to Settings > Apps, find the app, and tap Uninstall. Scam apps often use generic names and icons, so look for anything installed on the day of the click.
3. Remove admin rights if needed. If Uninstall is grayed out, the app may have made itself a device administrator. Search Settings for "device admin apps," switch its access off, then uninstall.
4. Close the side door. Open Settings > Apps > Special app access > Install unknown apps, and turn the permission off for your browser and for any app you don't recognize.
5. Scan the phone. In the Google Play Store, tap your profile icon, then Play Protect, then Scan.
6. Reset if signs persist. If pop-ups, unknown apps, or strange texts keep coming back, back up your photos and contacts, factory reset the phone, and reinstall apps only from Google Play.

Menu names are as of September 2026 and vary between Pixel, Samsung, and other brands, so the search box at the top of Settings is the quickest way to find each one. The FTC's instruction for suspected malware, written with computers in mind, follows the same pattern: update your security software, run a scan, and remove anything it identifies as a problem. And the FTC's phone security advice to back up your phone regularly to the cloud or a computer is what makes a reset painless if you end up needing one.

Once the app is gone, treat any account you used on the phone while it was installed as exposed. Change those passwords from a clean device, starting with email and banking, and tell your bank that a malicious app was on the phone you use for its app.

On iPhone

iPhones make it hard to install apps from outside the App Store, so scam pages aimed at iPhone users usually push something else. Each of these can be removed in a minute or two:

• Configuration profiles. A page may ask you to download and install a profile, sometimes described as a certificate or a security update. Profiles can change settings such as VPN and network behavior. Check Settings > General > VPN & Device Management, and remove any profile you didn't install for work or school.
• Calendar subscriptions. Accepting a calendar prompt can subscribe you to a calendar that fills your schedule with fake alerts and links. In the Calendar app, tap one of the junk events and look for Unsubscribe from this Calendar, or delete it from the subscribed calendars listed in your Calendar settings.
• Home Screen web apps. If you added the scam site to your Home Screen, press and hold its icon and delete it. On recent versions of iOS, a web app added this way can ask to send notifications, so deleting it also ends those alerts.
• Apps you were told to trust. If a page walked you through installing an app and then trusting its developer in Settings, delete the app, and remove the matching entry under VPN & Device Management.

After removing anything, update iOS under Settings > General > Software Update. Menu names are as of September 2026 and may differ slightly between versions.

Clicked a Phishing Link on iPhone or Android? Settings to Check

Beyond apps and profiles, a scam page can leave smaller traces in your browser. None of them is dangerous by itself, but each keeps the scam in front of you. These checks take a few minutes and are worth doing even if you're sure you typed nothing.

iPhone

• Clear the site's data. In Settings > Apps > Safari > Advanced > Website Data, search for the scam site and delete its entry, which removes cookies it set. On older versions, Safari's settings sit directly under Settings > Safari.
• Turn on Fraudulent Website Warning. It's in Safari's settings under Privacy & Security, and it shows a warning page when Safari recognizes a suspected phishing site.
• Filter texts from unknown senders. Moving messages from strangers into a separate list makes it less likely you'll tap the next scam link mid-scroll. Our guide to scam text replies lists the filter and junk-reporting menus for both platforms.

Android

• Revoke notification permission. If the page asked to send notifications and you allowed it, fake virus warnings and prize alerts can keep arriving through Chrome. In Chrome, open the three-dot menu, then Settings > Site settings > Notifications, and remove the site from the allowed list.
• Clear the site's data. Under Site settings, All sites lets you find the scam site and delete what it stored.
• Turn on Safe Browsing. In Chrome's Settings > Privacy and security > Safe Browsing, choose Enhanced protection, or at least Standard protection.
• Keep spam protection on in Google Messages. It flags many suspected scam texts before you open them.

For people at higher risk

If your work, activism, journalism, or public profile makes you a likely target for sophisticated attackers, a suspicious link deserves more than a quick cleanup. Apple's Lockdown Mode on iPhone and Google's Advanced Protection on recent Android versions trade some convenience for a much smaller attack surface. If that describes you, report the click to your organization's security team as well.

Menu paths change with updates; the ones above are as of September 2026. If a name doesn't match, search for it by name in your phone's Settings app.

Signs the Click Led to Something Worse

Most clicks end quietly. A stolen password or card number isn't always used right away, though, so keep an eye out for these signs over the following weeks and months, and act the moment one appears.

Several of these come straight from the FTC's advice on spotting identity theft. It suggests tracking which bills you owe and when they're due, because a bill that stops arriving can mean someone changed your billing address; reviewing bills and bank statements for charges and withdrawals you didn't make; and checking your credit reports for accounts you don't recognize. The same FTC page lists what thieves can do with stolen identity details, including getting new credit cards in your name, stealing a tax refund, and getting medical care, so problems can surface in places far from the original text.

Be careful with the vaguer signs. A phone that runs warm, drains its battery faster, or feels sluggish can have plenty of ordinary causes, such as a recent update, an aging battery, or a busy app. On their own, they're weak evidence of malware. Unknown apps, profiles you didn't install, and messages you didn't send are much stronger evidence.

A simple follow-up schedule

• The day of the click: finish the steps for your situation and report the text.
• A few days later: check your email's recent sign-in activity, your bank and card transactions, and your phone's apps and profiles once more.
• Over the following months: read each statement as it arrives and check your credit reports. If your Social Security number was involved, leave the credit freeze in place until you actually need to apply for credit.

How to Report a Scam Link After You Clicked It

Reporting won't undo the click, but it helps carriers and investigators block the same link for the next person, and it creates a record in case you need to dispute a charge. The FTC's phishing guidance lists the core routes: forward the text to SPAM (7726), and report the attempt to the FTC at ReportFraud.ftc.gov.

• Your carrier. Forward the scam text to 7726, which spells SPAM on a phone keypad. Your carrier may reply asking which number sent it.
• The FTC. File a report at ReportFraud.ftc.gov. Include the text, the link as it appeared, and what you entered, if anything.
• IdentityTheft.gov. If personal or financial details were taken, report there too. According to the FTC's identity theft guide, you get a free personal recovery plan, can update the plan and track your progress, and can print pre-filled letters and forms for credit bureaus, businesses, and debt collectors. The FTC also runs a Spanish-language version, RobodeIdentidad.gov, and phone reporting with interpreters for other languages.
• The company that was impersonated. Most banks and large brands explain how to report phishing on their official websites. Reports help them warn other customers.
• The police. CISA suggests considering a police report along with a report to the FTC. If you lost money, a report number can help when you deal with your bank.
• Your employer. If a work phone or work account was involved, tell your IT team, whatever the outcome.

Keep your screenshots and a few notes in one place: when you tapped, what you entered, whom you contacted, and when. If a dispute or identity theft case drags on, that record saves you from reconstructing events from memory.

How to Avoid Clicking the Next Scam Link

The most reliable habit is also the simplest. When a text says something is wrong with an account, don't use its link to check; open the company's app or type its web address yourself. The FTC advises contacting a company through a phone number or website you know is real, and points out that legitimate companies won't email or text you a link to update your payment information.

A few more habits make the next mistake less likely:

• Let your password manager be a tripwire. Password managers normally offer your login only on the site where you saved it. If yours stays blank on a page claiming to be your bank, stop; the address is probably wrong.
• Switch to passkeys where offered. Because a passkey is tied to the real site, there's nothing for a fake page to collect.
• Read the address, but don't trust a clean one. CISA notes that malicious websites may look identical to legitimate ones while using a variation in spelling or a different domain ending. A misspelled address is a giveaway, but a correct-looking one isn't proof, and shortened links hide the destination entirely.
• Treat urgency as a warning sign. Deadlines measured in hours, threats of suspension, and suspiciously small fees exist to stop you from checking.
• Keep updates automatic. They're your defense against the rare link that goes after a software flaw rather than your judgment.

Give fewer strangers your real number

Scam texts need a working phone number, and every listing, form, and stranger that gets yours can add it to another list. You can't pull your number back from lists it's already on, but you can slow the spread. Our guides to the privacy mistakes that put your phone number at risk and protecting your number when selling online cover the common leaks.

For conversations with people you don't know yet, such as marketplace buyers, dating matches, or a contractor you found online, Ghost sends SMS with your real number masked. The recipient sees a protected sender ID, and Reply Links let them answer without learning your number. The marketplace safety page explains how that works for sellers talking to buyers.

Masking has limits worth knowing before you rely on it. Ghost hides your number from the people you text, but it doesn't filter texts arriving on your real number, can't stop you from tapping a link, and isn't meant for receiving verification codes. Your number also isn't hidden from Ghost itself, from carriers, or from lawful legal process, as the privacy summary explains. Masking reduces how often your number lands on new lists; the habits above protect you when a scam text arrives anyway.

Frequently Asked Questions

Sources

• FTC: How To Recognize and Avoid Phishing Scams
• FTC: What To Know About Identity Theft
• FTC: IdentityTheft.gov
• FTC: How To Protect Your Phone From Hackers
• CISA: Avoiding Social Engineering and Phishing Attacks
• FTC: ReportFraud.ftc.gov