First, stop and sort what actually happened
Most people react to a phishing page by changing everything at once, or by assuming the device is now infected. Neither helps you decide. The useful question is narrower: what did you type, submit, or run?
Use the worksheet below before you touch anything. Write the answer in one line per item. If you are unsure, mark it “unsure” rather than guessing.
| What happened | What it does and does not mean | First action |
|---|---|---|
| You clicked a link only | The page opened; nothing was submitted. A click alone does not establish that anything was installed. | Close the tab. Do not re-open the link. Note the sender and the claimed company. |
| You entered a password and pressed submit | The credential may now be known to whoever runs the page. This is the highest-priority case. | Change that password from a device you trust, starting with the account it belongs to. |
| You entered financial details (card, bank, payment app) | The details may be usable for fraud even if the account password is unchanged. | Contact the bank or card issuer using the number on the card or its official app. |
| You downloaded or opened a file | A file was saved or run. This is the only row where malware is a live question. | Do not open it again; follow the download steps below. |
| You did several of the above | Treat each row separately; one does not cancel the other. | Work top to bottom, password and financial rows first. |
Two limits matter here. A click is not proof of compromise, and a clean scan is not proof of safety. Scans look for what they know how to find; they do not certify that nothing happened. Treat “my antivirus said it’s fine” as one data point, not a verdict.
Confirm through a channel you chose, not the one that contacted you
The message itself cannot tell you whether it was genuine. The FTC advises independently contacting a company using a known genuine number or site when a message requests a link click or attachment.
The FTC advises independently contacting a company using a known genuine number or site when a message requests a link click or attachment. Source
In practice: open the company’s site by typing its address yourself or using its app, find the support or security contact there, and ask whether the message was theirs. Do not reply to the message, and do not use a phone number or link it supplied. If the company has no way to confirm a message, assume it was not genuine and act on the exposure rows above.
This step also tells you what to fix. If the company confirms the message was real, you may only need to log in normally. If it was not, the password row becomes urgent.
Handle a downloaded file without guessing
If you saved or opened a file, the FTC’s guidance is specific: update security software and run a scan.
If a malicious download is suspected, update security software and run a scan. Source
Editorial advice, not a sourced rule: keep the file rather than deleting it immediately if you may need to show it to your bank, employer or the company being impersonated. Move it to a folder you will not open by accident. Do not run it again to “check” whether it was the problem.
A scan result is a starting point. If the device starts behaving unusually — new login prompts, unfamiliar apps, browser settings you did not change — treat that as a separate signal and get help rather than re-running the same scan.
If you gave personal or financial information
The FTC points people who disclosed personal or financial information to IdentityTheft.gov for next steps based on what was lost.
If personal or financial information was disclosed, IdentityTheft.gov provides next steps based on the information lost. Source
That matters because the recovery path differs by what was exposed. A card number, a bank login and a national ID number do not lead to the same actions. Before you file anything, finish the worksheet so you can list exactly what you submitted.
For financial details, contact the bank or card issuer directly. For account passwords, change them from a trusted device and check the account’s recent activity and recovery settings. If the same password was reused elsewhere, change it there too — but do this after the account you actually submitted is secured, so you are not juggling several locked accounts at once.
Keep a recovery method you control
When you change a password, the platform will usually offer to update recovery details. Keep at least one recovery method you can actually access — a phone number, an authenticator app or an email inbox you control. Do not replace recovery details with a throwaway address you cannot get back into, and do not remove your existing recovery methods until the new ones are confirmed working.
If you decide to close an account that was exposed, complete the closure first and only then remove the recovery methods attached to it. Removing a login connection or emptying a profile does not by itself establish that stored data is gone.
Decide what to do next
Use this checklist in order. Stop when a row does not apply.
- Worksheet complete? Every row marked yes, no or unsure.
- Password submitted? Change it on the real site, from a trusted device, then check recent activity and recovery settings.
- Financial details submitted? Call the bank or card issuer using a number you looked up yourself.
- File downloaded or opened? Update security software, run a scan, and keep the file for reference without re-opening it.
- Personal information disclosed? Use IdentityTheft.gov to see next steps for what was lost.
- Message still unconfirmed? Contact the company through a channel you chose and ask whether it was genuine.
- Recovery intact? At least one recovery method you control is confirmed working.
If the message claimed to come from a social platform’s support or verification team, the same logic applies, and the next step is to check how that platform actually contacts users: checking fake customer support accounts on social platforms.
What you should not do: pay anyone who contacts you offering to “remove” the compromise, send a screenshot of your recovery codes, or re-enter the same details on a second page to “verify” the first. None of those steps is supported by the guidance above, and each one creates a new exposure.
Where this leaves you
The goal is not to prove you are safe. It is to close the specific exposure you created and keep a way back into your own accounts. A click with nothing submitted is usually a small problem. A submitted password plus reused credentials is a larger one. A downloaded file is a separate question that a scan can inform but not settle.
If you are unsure which row you are in, assume the more serious one until you can check. That is not alarmism; it is the cheapest way to avoid discovering the problem later.