The page may collect information
A false sign-in, payment or identity form can send entered details directly to the operator.
Technology, platforms and channels
I clicked a scam link — what should I do now?
A click is not one single outcome. You may have opened a page and stopped, entered information, downloaded a file, installed software, granted a permission or approved a payment. The right response depends on the furthest action taken.
Page P-021Guidance pageReviewed 29 August 2026
Key Guidance
Close the page and do not enter anything else. If you only opened it, report the link and monitor. If you entered a password or bank details, downloaded or installed something, approved a prompt or sent money, protect that account, device or payment route at once.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Guided route 2
I may have shared money, personal details or account access
Current position: Step 2 of 4 — Review links, files and access. Read the guides in the order shown.
Understand the issue
Why this matters to you
Fear can produce two unhelpful reactions: assuming that nothing happened or assuming that everything is compromised. A short action reconstruction produces a more accurate response.
A download changes the device question
Files, apps, browser extensions, profiles and permissions can create risks that merely viewing a page does not.
A real service may be imitated
The page can copy a familiar brand while sending sign-in details or payments to a different destination.
The message may continue after the click
A caller or chat contact may interpret warnings, request codes or guide the person through the false page.
Consequences and movement
What may happen next
Identify the furthest completed action. If several happened, complete every relevant branch, beginning with money and critical account access.
Opened only
Close the page, do not revisit it, report the URL and watch for unusual prompts or activity.
Entered a password or code
Use the genuine service from a trusted route, change the exposed credential and review sessions, recovery details and recent activity.
Downloaded, installed or permitted
Disconnect if active control is possible, run trusted security checks and get official or trusted technical help.
Entered bank details or paid
Contact the bank or payment provider at once and explain exactly what was entered, approved or transferred.
Practical response
What you should do
Do not use the suspicious page to change a password, contact support or cancel a payment. Re-enter each genuine service independently.
- Stop the page interactionClose the page or app, cancel any download and do not accept notifications, profiles, extensions, permissions or software.
- Write down the action sequenceRecord what you clicked, entered, downloaded, installed, approved and paid. This determines which recovery owners are needed.
- Protect exposed accountsFrom the genuine service, preferably on a trusted device, change exposed and reused passwords, remove unfamiliar sessions or recovery details and strengthen sign-in.
- Check the device where necessaryIf a file was opened or software installed, run the device’s trusted security scan and follow official recovery guidance. Do not keep using it for sensitive sign-ins while control is uncertain.
- Contact the bank for financial exposureTell the bank at once if card, banking, security-code or payment information was entered or an action was approved.
- Report without reopeningUse the message, browser history or copied URL to report the suspicious site. Preserve the original message and any resulting alerts or transactions.
Look more closely
The risk depends on what happened after the click
Opening a link is not the same as entering details, installing software, granting permission or paying. Recovery should follow the action actually taken rather than treating every click as identical.
A message, advert or result presents a link.
Urgency, reward, curiosity or account concern makes opening feel necessary.
The page imitates a trusted service or expected process.
The person may disclose, download, permit, approve or pay.
Each completed action is routed to the owner able to contain it.
Selected history
Historical cases and lasting lessons
Credential-phishing pages
False sign-in pages have imitated familiar services to collect passwords and other security information.
Lasting lesson: The page appearance does not confirm its destination. Protect the genuine account after any credential entry.
Malicious downloads and instructions
Phishing links may lead to files, software or steps that expose the device as well as information.
Lasting lesson: The technical response depends on the download, installation and permissions—not the click label alone.
Transferable understanding
Patterns over time
The first click is often not the final action
The page is designed to continue movement through sign-in, payment, installation or support.
Brand recognition can replace route checking
A familiar layout can make the destination feel genuine before the address and process are independently checked.
Panic can deepen exposure
Returning to the same page for cancellation or help can create another opportunity to enter information.
Recovery needs multiple owners
A service provider secures its account, the bank handles financial exposure and trusted technical support restores the device.
Plain-language answers
Common questions
Is my device infected because I clicked?
Not necessarily. A click can open a page without installing software. Risk rises if a file, app, extension, profile or permission was downloaded, opened, installed or granted.
Should I change every password?
Change any password entered on the page and any account that reused it. Prioritise email, banking, password managers and other high-value services.
Can I revisit the page to take a screenshot?
Do not reopen it only for evidence. Preserve the original message, browser history, address or existing screenshot instead.
What if the page showed an error after I submitted?
An error does not prove that the information failed to send. Treat the entered information as exposed and protect the genuine service.
Follow the action, not the fear
Report the link, then protect every account, device or payment route touched after the click. Contact the bank at once for financial exposure and use trusted technical guidance after a download or installation.
Scamology Insights
Map the click into the action it enabled
These learning resources can help you trace what happened after you clicked—from sharing details to giving access or sending money—so you can take the right recovery steps. Links are intentionally withheld in this production version.
Guided route 2 · Step 2 of 4
Continue your route
The next guide follows directly from this one.
Continue understanding
Explore related guidance
Evidence and currency