What should I do if I click a phishing link? First: don’t panic, and don’t feel stupid. Phishing has become frighteningly sophisticated — fake bank emails, parcel delivery texts, “your account will be suspended” warnings — and clever, careful people fall for them every day. Clicking the link is not the disaster; what you do in the next few minutes determines whether it’s a near-miss or a catastrophe. I’ve helped friends through this exact situation, and the recovery playbook is clear. Here’s what to do, in order.

Step 1: Stop. Don’t enter anything

The moment you realise (or suspect) it’s phishing: do not enter any username, password, card details or personal information. Close the tab or app. If a download started automatically, cancel it — don’t open the file. Clicking alone rarely compromises you; it’s what you type into the fake page (or what you download) that does the damage. If you clicked but entered nothing and downloaded nothing, you’re almost certainly fine — skip to the precautionary steps at the end.

Step 2: Disconnect if you downloaded something

If you downloaded and opened a file, or the site asked you to install something:

• Disconnect from the internet — turn on aeroplane mode or unplug Ethernet. This stops malware phoning home or spreading.
• Don’t log into anything sensitive (banking, email) on that device until it’s been scanned — assume keystrokes could be monitored.
• Run a full antivirus scan — Windows Security full scan, plus a Malwarebytes free scan as a second opinion. See our guide on free antivirus options.
• If the scan finds something serious (trojans, info-stealers), consider the device compromised until a professional confirms it’s clean — and change passwords from a different clean device.

Step 3: If you entered login details — act within minutes

This is the urgent scenario. Attackers use stolen credentials within minutes, often automated:

• Change the password immediately — on the real site (type the address yourself, don’t follow links), from a clean device if possible. Use a strong unique password, ideally from a password manager.
• If it was your email password, this is critical — email unlocks password resets everywhere. Follow our hacked email recovery guide: check forwarding rules, unknown sessions, and recovery options.
• Enable two-factor authentication right now if it wasn’t on — it can lock the attacker out even with your password. See how to set up 2FA.
• Check for unauthorised activity — recent orders, sent emails, changed settings, new payees on banking.
• If banking details were entered, call your bank immediately on the number on your card. They can freeze and monitor. Don’t wait to “see if anything happens”.

What should I do if I click a phishing link in a text message?

Smishing (SMS phishing) deserves special mention — parcel delivery scams (“Royal Mail: pay £1.99 redelivery fee”) are rampant in the UK:

• Forward the text to 7726 (free) — it reports it to your network and helps get it blocked.
• Don’t call any number in the message. Look up the company independently if you’re unsure about a delivery.
• Delivery companies never ask for payment via text link for redelivery — Royal Mail, DPD, Evri don’t operate that way. That single fact defeats most parcel scams.
• Banks never ask you to “verify” via texted links. If in doubt, call the bank on a known number.

Reporting it (helps everyone)

• Forward phishing emails to report@phishing.gov.uk — the NCSC’s reporting service. It feeds takedown operations that have removed hundreds of thousands of scams.
• Forward scam texts to 7726.
• Report to Action Fraud if you lost money or shared financial details — actionfraud.police.uk or 0300 123 2040.
• Report the fake site to the impersonated company — most banks have a phishing report address.

Reporting feels pointless in the moment, but it’s how scam infrastructure gets dismantled. The NCSC’s takedown service is genuinely effective — your report contributes.

Learning the signs for next time

Phishing preys on urgency and authority. Red flags to internalise:

• Urgency + threats: “act in 24 hours or your account closes” — legitimate companies don’t do this.
• Generic greetings: “Dear customer” from your bank (which knows your name).
• Slightly wrong sender addresses: microsft-support.com, royalmai1.co.uk — look carefully.
• Hover before you click: on a computer, hovering shows the real destination. On phones, long-press to preview.
• Too good / too scary to be true: unexpected refunds and unexpected account closures are the two emotional levers.

The golden habit: never log in via a link. If a message says there’s a problem with your account, open the app or type the website address yourself. This single rule defeats nearly all phishing.

Phishing at work: protecting your employer too

Phishing doesn’t just target personal accounts — business email compromise costs UK companies millions yearly. The work variants: fake invoices from “suppliers” with changed bank details, CEO-fraud emails (“urgent transfer needed — don’t call, I’m in meetings”), and fake IT messages harvesting logins. If you handle payments or have access to company systems, the stakes multiply. Company defences: verify payment-detail changes by phone on a known number (never the number in the email), be deeply suspicious of urgency plus secrecy (“don’t tell anyone”), and report suspicious emails to your IT team immediately — they’d rather investigate ten false alarms than one breach. Many employers run simulated phishing tests; treat them as free training, not entrapment. And the same never-log-in-via-links rule applies at work — arguably more so, since a compromised work account can expose customer data and trigger GDPR notification obligations.

If your employer hasn’t trained you on phishing, ask — it’s their legal and commercial interest, and raising it marks you as security-conscious, not paranoid.

The bottom line

What should I do if I click a phishing link? Don’t enter anything; close it. If you entered credentials, change them immediately on the real site, enable 2FA, check for unauthorised activity, and call your bank if money details were involved. If you downloaded something, disconnect and scan. Then report it (7726 for texts, report@phishing.gov.uk for emails) and adopt the never-log-in-via-links rule. Clicking is human; the recovery is what counts — and now you know it.

NCSC phishing guidance and Action Fraud are the official UK resources.