I clicked a phishing link: what to do

First, the next five minutes

1. Close the page. Do not enter anything more, and do not click anything else on it.
2. If it happened on a work device or account, tell your IT or security team now. Speed matters more than being sure.
3. Use a different, trusted device if you can for the changes below, in case the first one is compromised.
4. Keep the original message. Do not delete it, because it is evidence and can be analysed or reported.

You only opened the link

Opening a page is usually low risk if nothing downloaded and you entered nothing, but a page can try to exploit an outdated browser or push a download.

• Close the tab and the browser. Reopen it and check that no unknown extension or download appeared.
• Update your browser and operating system.
• If a file downloaded, do not open it. Delete it and run a full scan with your security software.
• If the page asked you to allow notifications, deny them or remove the site's permission in the browser settings.

You entered a password

1. Change the password of that account right away, from the official site or app, typed in by hand.
2. Change it everywhere else you used the same or a similar password. Use a unique password for each account, ideally generated by a password manager.
3. Turn on two-step verification (an authenticator app, a passkey or a security key is stronger than a text message) if the account supports it.
4. In the account's security settings, sign out of all other sessions and devices and review which apps have access.
5. For email accounts, check for forwarding addresses and filter rules you did not create. Attackers use them to keep reading your mail. Check the recovery phone number and recovery email too.
6. Look through recent activity and sent mail for anything you did not do. Warn your contacts if the account sent anything.

You entered card or bank details, or sent money

1. Call your bank or card issuer at once, using the number on the card or the official site, and ask to block the card or the transfer. Do not use a number from the message.
2. Check recent transactions and set up alerts.
3. Be ready for follow-up calls and messages from people who claim to be the bank. Hang up and call back on the official number.
4. If you lost money, report it to the police. Banks and authorities often ask for a report reference.

You opened an attachment

• Disconnect the device from the network if you can, and do not enter any more passwords on it.
• Run a full scan with up-to-date security software. On a work device, stop and call IT instead of trying to clean it yourself.
• If the file asked you to enable macros or editing, assume the device may be compromised. Change important passwords from a different, trusted device.
• For a serious doubt, back up your files and ask a professional about a clean reinstall.

Then report it

Report the message to your mail provider and to the national agency. The steps for Gmail, Outlook, CERT Polska and international options are in how to report a phishing email. If you have the original, save it as an .eml file first.

To understand how the message fooled you, and to spot the same signs next time, read how to tell if an email is phishing.