Free Tool
Clicked a Phishing Link? Triage Tool
You clicked a link you now think was phishing. Stop, breathe, and work through this in order. Tell the tool what happened — whether you clicked only, entered a password, entered card details or downloaded a file — and it will build the exact recovery steps for your situation, in the order that matters.
Educational guidance, not bank or police advice. This tool gives general recovery steps. If money was taken or your identity was used, contact your bank and your local police or fraud-reporting service directly — their instructions override anything here.
What this tool does
Most phishing damage happens in the minutes after the click, when people panic and either ignore what happened or do the wrong thing first. This triage tool slows that down. It asks four plain questions: did you only click the link, or did you also type in a password, enter payment details, download a file, or give someone remote access to your device? Your answers decide which steps apply to you, because the recovery for a clicked link is very different from the recovery for a stolen card number.
The tool then gives you an ordered checklist. The order matters: disconnecting and changing passwords come before reporting, and reporting comes before trying to clean up the damage yourself. Each step explains why it is there in one sentence, so you understand the reasoning instead of following instructions blindly. Nothing you enter leaves this page — there is no form submission, no account, and nothing stored.
The tool is built for the most common situation: an ordinary person who clicked a suspicious link on their phone or computer and wants to know whether they are in trouble and what to do next. It does not diagnose malware, it does not check your accounts, and it cannot tell you whether a specific link was malicious — only the steps that make you safe whichever way it turns out.
Try it
Tick everything that happened, then get your steps. Nothing you tick leaves this page.
First: do not enter anything else on that page, and do not call any number shown on it. Tick what happened above, then get your steps.
How it works
The triage logic follows the same order security responders use: contain, then recover, then report. Containment means stopping the damage from spreading — close the page, disconnect from the internet if a file was downloaded, and do not type anything else. Recovery means taking back control of anything that was exposed — changing passwords (starting with your email), cancelling a card, or removing software that someone else installed. Reporting means telling the organisations that can act: your bank, the company being impersonated, and your country's fraud-reporting service.
What you entered decides the urgency. A clicked link with nothing typed in is usually low risk, but still worth a cautious check of your browser and a scan with your security software. A password means changing that password everywhere it was reused, starting with your email — because access to your email lets an attacker reset almost everything else. Card details mean calling your bank now, not later, and asking them to freeze or replace the card. A downloaded file means treating the device as possibly compromised: disconnect it, run a full scan with reputable security software, and consider professional help before using it for banking. Remote access means the other person may have installed software or copied files — disconnect immediately and get the device checked by someone you trust.
The tool's checklist is deliberately short. In a stressful moment, a list of twenty steps is worse than useless; six steps in the right order, each with a reason, is something a person can actually do. The guide linked below covers the same ground in more depth, including what to do if money was already taken and how to report phishing in the UK and the US.
Limitations
This tool cannot tell you whether the link you clicked was actually malicious, and it cannot check your device or your accounts. A clean result here does not mean nothing happened, and the tool's steps are general guidance for the most common cases — unusual situations, such as a work device, a shared family computer, or a business account, may need your IT department or your bank's fraud team instead.
- If money has already left your account, call your bank immediately — do not wait to finish this checklist.
- If you gave someone remote access to a work device, tell your IT department straight away.
- Never call a phone number shown on the suspicious page itself, and never install software a caller tells you to install.
Examples
Example 1 — clicked only, nothing entered. You tapped a delivery link, realised the page looked wrong and closed it without typing anything. Your steps: close the browser tab, clear the browser's recent downloads if anything started, run a scan with your security software, and watch for unexpected messages over the next few days. You do not need to change passwords — nothing was given away — but stay alert.
Example 2 — entered a password. You logged in on a page that turned out to be fake. Your steps, in order: change that password on the real site straight away; change it on every other account that used the same password, starting with your email; turn on two-factor authentication on your email and bank; check your email's sent folder and your account's recent activity for anything you did not do. Then report the fake page to the company it impersonated.
Example 3 — entered card details and downloaded a file. This is the most serious combination. Your steps: call your bank now and ask them to freeze the card and check for transactions; disconnect the device from the internet; do not open the downloaded file again; run a full scan with reputable security software; if the device was given remote access or behaves strangely, get it checked by a professional before using it for banking. Then report the fraud to your country's reporting service and keep the reference number.
Frequently asked questions
I only clicked the link — am I in trouble?
Probably not, if you entered nothing and downloaded nothing. Close the page, run a scan with your security software, and stay alert for a few days. If a file started downloading, do not open it, and scan your device.
Should I change my password if I only visited the page?
If you did not type a password anywhere, there is nothing to change. Change it only if you entered it on the suspicious page — or if you used the same password on other accounts, change it there too.
Who do I report a phishing link to?
Report it to the company it pretended to be from, through their official phishing reporting address, and to your country's fraud service — Report Fraud in the UK, the Internet Crime Complaint Center (IC3) in the US. Your email provider's report button helps too.
The page asked me to call a number. Should I?
No. Never call a number shown on a suspicious page. If you need to contact a company, find its real number on its official website or app, typed in by you.
Can I check whether the link was really phishing?
There is no safe way to check by clicking it again. If you must investigate, use the company's official app or website to see whether the message matches anything real — for example, a genuine delivery alert should match a real tracking number.