You get a text. “Your parcel is on hold, update your delivery details.” You tap, the page looks real, you type something… and your stomach drops, because it was a phishing link. Now what?
Don’t panic, there’s almost always something you can do. Unlike computer viruses, which copy themselves, phishing needs you to make a move. Along the way you’ll find out why the padlock wouldn’t have saved you and who falls for it most. At the end there’s a card to send to the people you care about.
Checklist if you clicked on a phishing link
Pick what you did after the click and tick off the steps as you go. Your phone remembers them, even if you close the page.
Right away, whatever happened
- Close the phishing page and don’t type anything else.
- Don’t reply or call any number in the message.
- Screenshot the message and the page address, you’ll need them to report it.
If you entered a password
- Change it now, from the official app or by typing the address yourself.
- Change it anywhere else you use the same password.
- Sign out of every device on the account.
- Turn on two-step verification.
- If it was your email, check your recovery email and phone and your forwarding rules.
If you gave away card details or a text message code
- Call your bank on the number on your card or in the app, and block the card.
- If you gave away a text message code, tell the bank.
- Check the last few days of transactions.
- Dispute any payment you didn’t make.
- Report it to the police and keep a copy.
If you downloaded a file or installed an app
- Disconnect from the internet, both Wi-Fi and mobile data.
- Delete the file and uninstall the app.
- Run an antivirus scan, or Play Protect on Android.
- If the app lets someone control your phone, call your bank.
In the days after
- Report the message to the authorities in your country.
- Report the fake page to Google.
- For a few weeks, watch your transactions and sign-in alerts.
- Warn the people close to you, the next message might land on their phone.
You clicked on a phishing link… what actually happened?
In most cases, just opening a phishing link isn’t enough to do damage. The real danger comes after, from what you typed or downloaded.
Think of a fake branch of your bank. Walking through the door costs you nothing. The problem is if you leave your house keys at the counter.
So there’s only one question that matters… what did you do after the click?
- Just looked at the page and closed it.
- Typed a password into it.
- Entered your card details, or a code you got by text.
- Downloaded a file or installed an app.
If you only looked, you can skip straight to the part about reporting it. Each of the other cases has its own section.
And don’t feel stupid. Whoever builds a phishing link is counting on you being in a hurry. Besides, getting it wrong, working out why and fixing it is the only way to get better, here too.
Ever wondered how long it takes us to fall for it? According to Verizon’s 2024 report on data breaches, half of the people who fall for a phishing email do so in under 60 seconds.
Let’s start with the most common case, the password.
What should you do if you typed your password?
Change it now. But not from the link you received. Open the official app, or type the site address yourself.
Whoever stole it with the phishing link will try to use it as soon as possible. And they often don’t stop there… they try the same password on your email, your social accounts, Amazon. So change it everywhere you use it.
Then kick everyone else out. Almost every service has an option like “Sign out of all devices” or “Where you’re signed in”. If someone has already got in, this throws them out. It’s the principle of least privilege applied to your own accounts… an access you don’t control is a door left open.
Finally, turn on two-step verification. With it, the password alone is no longer enough to get in, you also need your phone.
If it was your email password, check two more things scammers love to change quietly. The first is your recovery email and phone number. The second is any filter or rule that forwards your mail to another address. Google recommends the same in its guide for hacked accounts.
A password takes a minute to change. With your card, though, every minute counts.
What if you entered your card details?
Don’t wait on this one. Call your bank on the number on the back of your card or in the app, and have the card blocked. Never call the number in the message.
If you also gave away a code you got by text, tell the bank. That code authorises payments, and it’s exactly what they were after.
Remember paying contactless with your phone? There the shop gets a stand-in number, never your real one. On the page behind a phishing link, though, you type the whole number yourself.
Then check your recent transactions. In the EU the payment services rules give you up to 13 months from the debit date to dispute a payment you didn’t make. Report it to the police too, and keep a copy, because your bank may ask for it.
And there’s news if you live in the EU. A customer of a Polish bank typed her online banking login into a fake site sent by a fake buyer, and lost about €700. Her bank refused to pay her back, calling her grossly negligent.
On 15 October 2026 the Court of Justice of the European Union clarified a rule that applies to you too.
Your bank must refund you right away, even if it thinks you were careless.
It has until the end of the next business day, as long as you told it without delay. Only later, if it proves you were grossly negligent, can it ask for the money back. The one exception is if it suspects you’re the fraudster.
And what if the phishing link started a download?
What if you downloaded a file or an app?
Here the order matters.
- Disconnect from the internet, both Wi-Fi and mobile data, so whatever you installed can’t send anything out.
- Delete the file and uninstall the app.
- Run a check. On Android, make sure Play Protect is on in the Play Store, and on Windows open Windows Security and run a Quick scan.
An app that arrives this way is often a trojan, a program that looks harmless while it works for someone else. It’s a close relative of computer viruses, the ones that jump from one computer to the next. So don’t open any other files that came with that message, and don’t pass them on to anyone.
There’s also a more serious case. Maybe a fake bank employee had you install the app over the phone, “to block a suspicious payment”. In that case it may be a program that controls your phone remotely. Uninstall it and call your bank right away, using the official number.
So far you’ve protected yourself. Now it’s time to protect everyone else.
Why report a phishing link if you didn’t lose anything?
Reporting takes two minutes. But it protects the next person who gets the same phishing link tomorrow, maybe your mum.
- In the UK, forward the text to 7726 for free, as the National Cyber Security Centre explains.
- In the US, report it on ReportFraud.ftc.gov, as the Federal Trade Commission suggests.
- Anywhere else, to the police in your country, many of which take reports of online fraud on their website.
- To Google Safe Browsing, so it can warn anyone who tries to open the same page.
- To the company being imitated, like your bank or the courier, through its official website.
Do you think it’s mostly grandparents who fall for scams? In its October 2026 report to Congress, the FTC says older adults keep reporting losing money to fraud at lower rates than younger adults.
So it isn’t about age, it’s about being in a hurry. But then, how could you have spotted it before?
How do you spot a phishing link?
The page looked real. The logo was right, and there was even a padlock next to the address.
You might not know this, but Google removed the padlock from Chrome. Its own 2021 research found that only 11% of people knew what it really meant, and almost every phishing site has one. The Register tells the story.
The padlock only says the connection is encrypted. In other words nobody can read what you send along the way… even when you’re sending it straight to the scammer.
What gives a phishing link away is the address. Look at the site name and read it from the right. In dhl.com.example.com the last two parts are example.com, and that’s the real site. DHL has nothing to do with it.
Then there’s almost always a suspicious rush, like “within 24 hours”. And there’s a request the real company would never make by text, like your password or the code you just received.
And the name? Phishing is a respelling of fishing, with the ph probably borrowed from phreaking, the phone hackers. One of the most famous called himself Captain Crunch, because a toy whistle from Cap’n Crunch cereal boxes played exactly the tone that let you call for free.
Frequently asked questions about phishing links
What happens if you open a phishing link without entering any details?
In most cases nothing serious, because the real danger comes from what you type or download. Close the page, don’t reply to the message and report it, as the checklist explains.
Will your bank refund you if you clicked on a phishing link?
In the EU, in principle yes, and right away. The Court of Justice of the European Union made this clear on 15 October 2026, as long as you told your bank without delay. If it says no, it has to answer your complaint in writing, and Your Europe explains where to turn next.
I clicked on a phishing link on my iPhone, what should I do?
Follow the same steps in the checklist, because on an iPhone too what matters is what you did after the click. If you typed your Apple Account password, Apple advises you to change it immediately and make sure two-factor authentication is on. For a suspicious message in Messages, tap “Report Junk” under it.
Is a phishing link on WhatsApp any different from one by text?
No, it works the same way whichever app it comes from, so the same steps apply. In the UK you can forward a scam text to 7726, as the NCSC explains, and you can block the sender straight from the app.
And that parcel on hold?
Back to the text from the start. The parcel never existed, but now you know what to do in the minutes after the click, and in what order. Open the checklist and tick off the steps for your case. From there you can also download the card to print, and send it to the people you care about, twenty-somethings included.
And if you’re wondering why, when you pay with your phone, your card number never reaches the shop, read how contactless payment actually works.
If you’d like to get the next articles too, sign up for the newsletter. I only write when I have something worth sharing.
Byeee.
