Clicked a link? Here’s exactly what to do

First: you are not in trouble, and you are not foolish. Scams are industrially produced to fool busy, kind, normal people, and clicking a link is the single most common way anyone gets caught. What matters now is not the click; it is what you do in the next hour. Work through the steps that match what happened.

If you only clicked and closed the page

If you entered no information and installed nothing, the risk is usually low. Close the page, don’t download anything it offered, and update your device and browser so any known holes are patched. Run your device’s built-in security scan if it has one. Then keep an eye out for follow-up messages; being clicked once puts you on a list to be tried again.

If you typed a password

Go to the real website, typing the address yourself or using the official app, and change that password now. If you use the same password anywhere else, change it there too; that is the first thing scammers try. Turn on two-step verification while you are in the settings, and sign out of other sessions if the site offers it.

If you entered card or bank details

Call your bank immediately using the number on the back of your card, or dial 159, the anti-fraud number that connects you securely to most major UK banks. Tell them exactly what was entered and when. Banks handle this every day; the sooner they know, the more they can stop.

If you shared a one-time security code

Treat this as urgent. A code can authorise a payment or hand over an account in seconds. Contact the real organisation immediately through a trusted route and tell them a code was shared. Do not wait to see whether anything happens.

If you installed software or shared your screen

Disconnect the device from the internet: turn off Wi-Fi or unplug the cable. Then, from a different device, contact your bank before you reconnect. Remote-access software gives a scammer your hands and eyes, so the device should not touch your accounts again until the software is removed.

Afterwards, whatever happened

• Keep the evidence: screenshots, the email itself, phone numbers used. Your bank or the police may want them.
• Report it to Action Fraud on 0300 123 2040 or at actionfraud.police.uk (in Scotland, call Police Scotland on 101). Reporting is not about embarrassment; it is how these operations get mapped and shut down.
• Tell someone you trust. Scams rely on secrecy and shame, and a calm second person helps you finish the steps and spot anything missed.