I clicked a phishing link. What should I do?
2 min read · Updated October 15, 2026
If you only clicked, close the page and run a security scan. If you entered a password, change it immediately on the real site and anywhere you reused it, then enable two-factor authentication. If you entered payment details, contact your bank straight away.
Case 1: you clicked but entered nothing
Close the tab. Most phishing pages need you to submit information to do harm, though some try to download files. Do not open anything that downloaded, update your browser and run a security scan if you are unsure.
Case 2: you entered your password
Assume the attacker has it. Change the password on the real site immediately, then change it on any other account that used it. Turn on two-factor authentication and sign out of all other sessions.
First, see what was actually exposed
Before you change anything, find out whether your address shows up in known breach records. The free check takes seconds.
Case 3: you entered payment or personal details
- ✓Call your bank or card issuer and report the incident.
- ✓Monitor your statements for unusual activity.
- ✓Watch for follow-up scams that reference what you shared.
Case 4: you installed something
Disconnect from the network, run a reputable security scan and consider restoring the device if you cannot be sure it is clean. Change passwords from a different, clean device.
Frequently asked questions
Can just clicking a link hack me?+
Rarely, if your software is up to date. The usual danger is entering information on a fake page or downloading a malicious file.
How can I tell if I entered my details on a fake page?+
Check the web address. A mismatch, odd spelling or an unexpected domain suggests a fake. When in doubt, change the password.
Should I tell my workplace?+
Yes, if it involved a work account or device. Fast reporting limits damage.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.