The first checks, in pictures
Start with these three checks. The pictures are simplified; the steps below explain the details.
Stop the interaction
Close the suspicious page. Do not enter more information.
See this step — Stop the interactionRecord what you shared
A click, a password, an installed file and a payment need different responses.
See this step — Record what you sharedUse a trusted route
Secure the exposed account or contact the relevant provider directly.
See this step — Use a trusted route
You notice the strange address only after the page has opened. The next step depends on what happened there: did you only view it, type a password, approve a sign-in, install something or make a payment? Treating all of those events as the same problem can waste time. Start by closing the suspicious interaction and writing a short factual record. Then follow the branch that matches your exposure. This guide helps with triage; it cannot inspect your device, declare it clean or replace your organisation's incident response process.
The first useful check
Stop interacting with the page. From a trusted route, secure any account whose credentials you shared, contact the payment provider if money or financial details were involved, and report work-device incidents to your organisation promptly.
Which situation sounds like yours?
Only viewed the page
Close it, check unexpected downloads and follow device guidance.
Shared credentials or a code
Secure the affected account through its official route.
Installed software or granted remote access
Stop sensitive activity and obtain appropriate device support.
Paid or shared financial details
Contact the financial provider through a trusted channel promptly.
Step 01
Write down the action, not just the link
Record approximately when the message arrived and what you actually did. Useful distinctions include opening a page, entering a password, sharing a verification code, granting an app access, downloading a file, running it and sending money. You may have done more than one. Keep the message as evidence without reopening its links or forwarding an active threat to other people.
Do not put passwords, full payment details or verification codes into the incident note. A simple timeline is enough to guide the response. If this happened on a work device or account, contact the organisation's security or IT team using a known channel and follow their instructions. Do that promptly rather than trying a long sequence of private repairs that may remove useful evidence.
Step 02
If you opened the page but entered nothing
Close the suspicious page and avoid interacting with pop-ups that claim to scan or repair your device. Check whether an unexpected download occurred, and do not open it. Keep the browser and operating system updated through their normal official update mechanisms. If you observe unusual behaviour, use the device vendor's security guidance or trusted technical support.
A click alone is not identical to handing over a password, but it is also not a basis for promising that nothing happened. The page may have learned that the link was active, and technical risks depend on the browser and device. Avoid both extremes: do not assume every click requires deleting the computer, and do not treat a normal-looking screen as proof of safety.
Step 03
If you entered a password or approved a sign-in
Use a trusted device and navigate directly to the affected service. Follow its compromised-account process, change exposed credentials where appropriate and review the account's security controls. If the password was reused, address the other accounts using it as well. Prioritise the email account that can reset access to your other services.
A shared verification code or an approved push may have allowed access even if you did not type the password on the suspicious page. Review recognised sessions and recovery details through the official account interface. Remove unfamiliar access using the provider's controls and enable suitable multifactor protection. A password change alone should not be treated as proof that every connected session or permission has been revoked.
Step 04
If you downloaded, installed or granted access
Distinguish a file saved to Downloads from a file you opened or software you installed. Also record any browser extension, configuration profile, remote-support session or app permission you approved. These are different kinds of access, and the relevant cleanup depends on the platform. Do not run the file again to see what it does.
For a managed device, let the organisation's team direct containment and investigation. For a personal device with signs of active compromise, stop sensitive activity and use another trusted device to seek official support and secure accounts. If remote access is ongoing, disconnect the affected device from the network. Do not rely on a single scan or an uninstall button as a universal guarantee that the incident is resolved.
Step 05
If money or financial information was involved
Contact the bank, card issuer or payment service promptly through its official app, the number on your card or another independently verified channel. Explain the action and time accurately, and ask about the steps appropriate to that payment or exposure. Do not call a number supplied by the suspicious message. Recovery possibilities depend on the payment method and circumstances.
Keep receipts and non-secret transaction references for the provider and relevant reporting service. Be alert to follow-up messages claiming that a fee is needed to recover the money. Do not send another payment to prove ownership or unlock a refund. If an identity document or other sensitive personal information was shared, use the relevant official identity-theft guidance for your country and situation.
Step 06
Close the loop and reduce the next opportunity
After the urgent steps, record what you changed, which provider you contacted and what remains unresolved. Check that the affected service's recovery contacts are still yours. Tell people through a separate trusted channel if your account sent suspicious messages to them. Keep the warning specific and avoid sharing the malicious link as a clickable invitation.
Build one practical habit around the incident: open sensitive services from a saved bookmark or typed address, verify unusual payment requests through a known contact, and use unique passwords with appropriate multifactor protection. The goal is not to become suspicious of every ordinary message. It is to separate a request arriving in a message from the trusted route used to act on it.
An example you can follow
The form collected more than a password
Illustrative example: Alex follows a delivery message, enters an email password and then types a sign-in code. The important record is not simply 'clicked a delivery link'. It is 'shared email credentials and a code'. Alex uses a trusted device to start the email provider's compromised-account process, reviews account access and checks other accounts that reused the password. The delivery company's real website can be checked separately. Identifying the exposed account prevents the irrelevant parcel issue from consuming the recovery time.
A useful incident timeline
Use facts you remember. Mark uncertainty rather than inventing details.
| Record | Include | Leave out |
|---|---|---|
| Time and channel | Approximate time; email or SMS | Unnecessary personal correspondence |
| Action | Typed password; approved prompt | The actual password or code |
| Device access | Downloaded versus ran a file | Running it again as a test |
| Response | Provider contacted; reference | Full card or identity-document data |
Questions you might still have
Does clicking always mean my account was hacked?
No. The risk depends on what happened and the device involved. A click alone cannot prove either compromise or safety.
Should I reply to ask whether the message is genuine?
Use an independently known channel instead. A reply to the suspicious sender does not verify identity.
Can an antivirus result prove everything is safe?
No single result can guarantee that. Account access, permissions and device exposure may require separate checks.
Sources & how this guide was made
Written by LoschaZ from the guidance below. The illustration is our own. Worked scenarios are labelled as illustrations; they are not customer stories or tests on every device. For product-specific steps, follow the current instructions for your device, account or item.
