Security · Fix-itDraft

I clicked a phishing link. Now what?

Draft. Not published yet.

You clicked a link in an email or text, and now you’re not sure it was real. Stop and take the next steps in order. Don’t enter a password, a code, or card details on that page, and don’t approve a sign-in prompt to “make it go away.”

If this happened on a work or school computer, tell your IT person first and follow their process. The steps below are for a personal Microsoft account or a small office where you’re the one who has to act.

What you do next depends on what already happened: you only opened the page, you typed a password, a file downloaded, or you entered payment details.

1. Close the page and don’t follow its instructions

Close the browser tab or app the link opened. Don’t sign in, don’t call a number shown on the page, and don’t install any “security” app it recommends.

If a file started downloading, cancel it. Don’t open the file.

If an Authenticator or “Approve sign-in” prompt appears on your phone and you were not signing in, tap Deny. Don’t type a number into the app unless you started that sign-in yourself.

2. Figure out what you actually gave away

Be honest with yourself about which of these happened:

  • You opened the link and closed it without typing anything, and nothing downloaded.
  • You entered a username, password, or a one-time code.
  • You entered a credit card, bank login, or other financial details.
  • A file downloaded, or you opened an attachment.

If you only opened the page and entered nothing, the UK National Cyber Security Centre’s guidance is that you may not need to do much more, but you should still watch your accounts for unusual activity and report the message. Keep going through the checks below if you have any doubt.

If this is a work account, stop here and tell IT, even if you think you entered nothing.

3. If a file downloaded, scan the PC before you change passwords

Microsoft’s own recovery steps for a compromised account start with a full malware scan. Do this before you change the password, so malware on the PC can’t capture the new one.

  1. Disconnect from Wi-Fi or unplug the Ethernet cable if you think a file may have installed something. You can reconnect after the scan, or use a different trusted device for the password change in the next section.
  2. Open Windows Security. You can press the Windows key, type Windows Security, and open it.
  3. Go to Virus & threat protection.
  4. Choose Scan options, select Full scan, then Scan now.
  5. Let the scan finish and follow any cleanup instructions it gives.

If your office uses a company security tool, tell IT instead of relying only on this scan.

Use a browser you trust. Type the address yourself or use the company’s official app. Don’t go back through the email.

For a personal Microsoft account (Outlook.com, Hotmail, Xbox, or a personal OneDrive):

  1. Sign in at account.microsoft.com/security.
  2. Change the password to something new and unique. Don’t reuse an old password.
  3. If you can’t sign in, use Microsoft’s sign-in helper or the “Forgot my password” flow on the official sign-in page.

For a work or school Microsoft 365 account, use the sign-in page your organization normally uses, or change the password from mysignins.microsoft.com/security-info if your admin allows it. If you can’t change it yourself, tell IT immediately.

If you use the same password on other sites, change those too, starting with email, banking, and any account that can reset other passwords.

If you entered a one-time code or approved a prompt, treat the password as exposed and change it anyway.

5. Review sign-ins and kick other sessions out

For a personal Microsoft account:

  1. From the Security basics page, open Recent activity. Microsoft shows sign-ins and other account events from the last 30 days.
  2. Open any activity you don’t recognize. In the Unusual activity section, choose This wasn’t me if it wasn’t you. In Recent activity, use Secure your account if something looks wrong.
  3. Use Sign out everywhere from your Microsoft account’s additional security options. Microsoft says this can take up to 24 hours to sign you out of browsers and apps (Xbox consoles are separate).

For a work or school account, review sign-ins at mysignins.microsoft.com and tell IT. They can revoke sessions and reset MFA in ways you may not be able to do yourself.

6. Check mailbox forwarding and rules

If someone got into your email, they sometimes add a forwarding address or a rule that hides messages. In Outlook on the web:

  1. Open Outlook on the web or Outlook.com by typing the address yourself.
  2. Go to Settings, then look under Mail for Forwarding and Rules.
  3. Turn off forwarding you didn’t set up. Delete rules you didn’t create.
  4. Check automatic replies as well, and turn off any reply you didn’t write.

On a work account, tell IT what you found. They can see settings that may not appear in your view.

7. Turn on a stronger sign-in, then report the message

If two-step verification or Microsoft Authenticator isn’t on yet, turn it on from your security info (personal) or mysignins.microsoft.com/security-info (work or school, if allowed). Prefer an authenticator app over a text message when you have the choice.

Then report the email so it can be blocked for other people:

  1. In Outlook, select the message.
  2. Use Report, then Report phishing if you see it. If your organization uses a Report Message or Report Phishing add-in, use that.
  3. Don’t click “unsubscribe” links in a suspicious message. Delete it after you report it.

In the United States, you can also report the scam at ReportFraud.ftc.gov.

If you entered payment details

Call your bank or card issuer using the number on the back of your card or on a statement, not a number from the email or the fake page. Ask them to watch the account or replace the card.

What not to do

  • Don’t keep using the fake page to “check” what happened.
  • Don’t send a screenshot of a one-time code or an Authenticator prompt to anyone who asked for it in that message.
  • Don’t pay a “refund,” “tax,” or “support” fee that the page or a follow-up caller demands.
  • Don’t assume a clean inbox means nothing happened. Check forwarding, rules, and recent sign-ins anyway.

Still stuck?

If you want hands-on help, I can connect remotely and walk through the account checks with you. Support is after-hours, nationwide, with local help in the Dallas–Fort Worth area. Details are on the Work with me page.

Sources checked