Clicked a scam link? What to do now

Clicking a link on its own does not mean your phone or computer has been taken over. What matters most is what you did on the page it opened.

Pick what happened

If you opened the page but typed nothing

1. Close the browser tab. Do not tap any buttons on the page or call any number it shows.
2. Clear the website data. On iPhone: Settings > Apps > Safari > Clear History and Website Data. On Android in Chrome: tap the three dots, then History > Delete browsing data.
3. Make sure your phone or computer is up to date (see the prevention steps below).
4. Report the message so it can be taken down (see "Report it" below).

That is usually the end of it. Keep an eye out for anything odd over the next few days, such as messages sent from your accounts that you did not write.

If you typed a password

1. Change the password on that account now. Go to the real website or app yourself — do not use the link.
2. Change it on every other account where you used the same password. The National Cyber Security Centre (NCSC) advises this because criminals try a stolen password on other sites.
3. Start with your email account. Whoever controls your email can reset the passwords on your other accounts.
4. Turn on two-step verification (2SV) so a password alone is not enough to get in. Our guide to two-factor authentication walks you through it.
5. If the account offers a passkey, the NCSC now recommends using one instead of a password where it is available.

If you have already been locked out, or you see messages or logins you do not recognise, follow the NCSC's steps for recovering a hacked account: contact the provider, check your email for forwarding rules you did not set up, change passwords, and log out all other devices.

If you typed card or bank details

1. Call your bank now. Dial 159 — a short number from Stop Scams UK that puts you through to your own bank, and works for more than 99% of UK retail bank current accounts — or use the number printed on the back of your card.
2. Tell them exactly what you typed and when. They can block the card and watch for payments.
3. Check your statements over the following weeks for anything you do not recognise.

If you downloaded or installed something

1. Delete the file or app.
2. On a computer, run a full scan with your security software. The NCSC advises letting it fix anything it finds.
3. On Android, open the Google Play Store, tap your profile picture, then Play Protect, and run a scan.
4. On iPhone, remove any app you do not recognise and check Settings > General > VPN & Device Management for profiles you did not add.
5. If the device still behaves strangely, the NCSC says a phone or tablet usually needs a factory reset, and a computer may need expert help.

Our guide Is my phone hacked? has the full checklist.

If you sent money

1. Call your bank immediately on 159 or the number on your card.
2. Report it to Report Fraud (this service replaced Action Fraud): reportfraud.police.uk (opens in a new tab) or 0300 123 2040. In Scotland, call Police Scotland on 101.
3. Citizens Advice says to call the police on 101 straight away if you transferred money to the scammer in the last 24 hours.

If you were tricked into sending money by bank transfer, you may be able to get it back. Under rules from the Payment Systems Regulator, banks and payment firms must reimburse victims of this kind of fraud, up to £85,000, for UK payments made on or after 7 October 2024. The exceptions are where the customer was complicit or grossly negligent, and a bank may apply an excess of up to £100. Report it as soon as you can and within 13 months of the payment.

Report it

Reporting takes a minute and helps get scam sites taken down.

• Scam text: forward it to 7726 (free).
• Scam email: forward it to report@phishing.gov.uk.
• Lost money or been hacked: Report Fraud on 0300 123 2040 or reportfraud.police.uk (opens in a new tab). In Scotland, call 101.

Not sure whether the message was real? Paste the details into our Scam Check.

Stop it happening again

• Don't use links in unexpected messages. Go to the organisation's website or app yourself.
• Keep your phone and computer updated. On iPhone: Settings > General > Software Update. On Android: Settings > System > Software updates (the wording varies by make).
• Use a different password for every important account, especially email. A password manager makes this easy. See how to create a strong password.
• Turn on 2SV or passkeys for email, banking, shopping and social media.
• Learn the signs. Our guides on scam texts and scam emails show what to look for.

Sources

• Phishing scams: If you've shared sensitive information — National Cyber Security Centre (opens in a new tab)
• Recovering a hacked account — National Cyber Security Centre (opens in a new tab)
• How to recover an infected device — National Cyber Security Centre (opens in a new tab)
• Report a scam text message — National Cyber Security Centre (opens in a new tab)
• Report a scam email — National Cyber Security Centre (opens in a new tab)
• Passkeys: what you need to know — National Cyber Security Centre (opens in a new tab)
• Avoid and report internet scams and phishing — GOV.UK (opens in a new tab)
• Stop, hang up, call 159 — Stop Scams UK (opens in a new tab)
• Report a scam — Citizens Advice (opens in a new tab)
• APP fraud reimbursement protections — Payment Systems Regulator (opens in a new tab)
• Don't panic – here's what to do if you accidentally click a scam link — Which? (opens in a new tab)
• Use Google Play Protect to help keep your apps safe — Android Help (opens in a new tab)
• Review and delete configuration profiles — Apple Support (opens in a new tab)
• Update your iPhone or iPad — Apple Support (opens in a new tab)

Last checked: 22 September 2026