Clicked a Scam Link? What to Do Right Now, Step by Step

You’re waiting for a parcel. A text arrives saying delivery failed, with a link to reschedule. You tap it without thinking, and now you’ve clicked a scam link. The page asks for a small fee and your card details, and halfway through typing, something feels off. Or maybe you finished, and the feeling only arrives afterwards.

First, breathe. It’s a common mistake, and what happens next depends far more on what you did after the click. So this guide is organised by what actually happened. Find your situation and follow those steps.

The 60-Second Version

1. Close the page. Don’t type anything else into it.
2. If you paid or typed card or bank details, call your bank or card provider now. Speed matters more than anything else on this list.
3. Change the password for any account you typed in, from a different device if you can, and anywhere else you reused it.
4. If you downloaded or installed something, scan the phone and remove it before you log in to anything important.
5. Report it. It helps you, and it helps stop the scammers hitting the next person.

What Happens After You’ve Clicked a Scam Link

Most scam links lead to a fake website built to look like your bank, courier or a shop. Its job is to get you to type something in, which is why the steps below depend on what you entered.

Sometimes a link goes further and starts a download. That is rarer, but Singapore’s police and cyber agency have warned about fake pages that trick people into running commands or installing things to “verify” themselves (SPF and CSA advisory, February 2025). Treat any page that asks you to install something as a red flag.

Scenario 1: You Clicked, But Entered Nothing

This is the best case, and it is very common. The UK’s cyber security agency says the point of a scam text is often to get you to click so the site can steal passwords or personal information, or install malware (NCSC). If you closed the page without typing anything, you most likely haven’t given up any details.

• Close the tab and don’t go back to it.
• Don’t download or install anything the page offers. Over the next few days, check for unexpected changes: unknown apps, a battery draining fast, pop-ups. Our phone-hacked warning signs guide lists what to look for.

Scenario 2: You Entered a Password

Assume whoever built the page now has that password. The US Federal Trade Commission’s advice is simple: log in right away and create a new password, and change it anywhere else you used the same one (FTC).

1. Open the real site or app yourself, not through the link, and change the password.
2. If you can’t log in, use that service’s account recovery. For Google, the hacked account help page walks through it.
3. Sign out of other devices. In a Google account, go to Security, then Manage all devices, and sign out of anything you don’t recognise (Google).
4. Change the password on any other account that shares it. This is where a password manager saves you.
5. Turn on two-factor authentication, preferably with an app rather than SMS. We explain the difference in authenticator app vs SMS.

If it was your email password, treat that as the most urgent case. Your email can be used to reset almost every other account you have. Australia’s eSafety guidance goes as far as suggesting you change your main email password even if you didn’t enter it on the fake page, just to be safe (eSafety).

Scenario 3: You Entered Card or Banking Details

This is the one where minutes count. Call your bank or card provider straight away, using the number on the back of your card or on the bank’s real website, not a number from the message.

• Say plainly: “I entered my card details on a scam website.” Ask them to block or replace the card and to check recent transactions.
• If money has already left your account, say so. In Singapore, the police’s Anti-Scam Command works with banks to try to freeze accounts and recover funds where possible (Scam.SG). In India, the 1930 helpline exists for exactly this, and the sooner you call, the better the chance of flagging the money (Vikaspedia).
• Watch your statements for the next few weeks. Small test charges often come first.
• If you also gave a government ID number or similar, see the identity section in the FAQs below.

Scenario 4: You Shared an OTP

A one-time password is meant to prove it’s you. If a scammer has your OTP at the right moment, they can approve a payment or log in as you. Singapore police have described scam pages that collect card details and the OTP together (SPF advisory).

• Treat this like Scenario 3 and call your bank immediately, even if you haven’t seen any charge yet.
• Ask whether the OTP was used for a payment, a new device or a changed phone number on your account.
• If your phone suddenly loses signal, read our guide on SIM swap attacks and contact your carrier.

Scenario 5: You Downloaded a File or Installed an App

This is the least common outcome but the one that needs the most cleanup, because the problem may now live on your device. The FTC’s guidance for a scammer with access to your device starts with updating your security software, running a scan and deleting what it finds, then taking steps to protect your personal information.

On Android

1. Stay off banking apps and don’t log in to anything important until you’ve cleaned the phone. Ofcom, the UK regulator, gives similar advice: avoid banking apps until you’re sure the device is safe (Ofcom).
2. Open the Play Store, tap your profile picture, then Play Protect, then Scan. Google says Play Protect checks apps whatever their source and can warn you about, disable or remove harmful ones (Google Play Protect).
3. Go to Settings, then Apps, and uninstall anything you don’t recognise or installed around the time you clicked.
4. Review permissions on the apps you do keep. Remove anything strange, such as accessibility access or device admin rights for an app that has no reason to ask.
5. If problems continue, back up your photos and contacts and do a factory reset. Our guide to wiping a phone covers the steps.

On iPhone

A link can still lead to a fake page or ask you to install a profile. Check Settings, General, then VPN & Device Management, and remove any profile you don’t recognise. Update iOS, check which apps have access to your data under Settings, Privacy & Security, then follow the earlier scenario that matches what you typed in.

On a computer

Update your security software, run a full scan and delete what it flags, as the FTC advises. Change your passwords from a different, clean device.

Your Situation at a Glance

Where to Report It

Reporting feels pointless when you’re already annoyed with yourself, but it is worth doing. Reports can lead to scam sites being taken down and numbers being blocked, and some systems use them to act on the money. Save the message, a screenshot and the link first. Here are the official routes by country. Numbers and services change, so if one doesn’t connect, check the linked official page.

• Singapore: call the 24/7 ScamShield helpline on 1799, or 999 if you need urgent police help (SPF). Call your bank at once if money moved, and use the ScamShield app to report messages.
• India: if money was taken, call 1930 and then file a complaint at cybercrime.gov.in. Still tell your bank, because reporting to 1930 doesn’t replace raising a dispute with them.
• United States: report at ReportFraud.ftc.gov. If you gave a Social Security number, the FTC points you to IdentityTheft.gov.
• United Kingdom: forward the scam text to 7726 (free). If you lost money or were hacked, report to Report Fraud on 0300 123 2040 or at reportfraud.police.uk. It replaced Action Fraud in December 2025 (City of London Police). In Scotland, call Police Scotland on 101.
• Australia: report the scam to Scamwatch and, if you lost money or information, to ReportCyber (cyber.gov.au). If you shared identity documents, IDCARE offers free help on 1800 595 160.
• Canada: report to the Canadian Anti-Fraud Centre online or on 1-888-495-8501, and to your local police (CAFC).

Your bank also needs to hear about it. Whatever country you’re in, that is the call that can stop money leaving.

The Second Scam That Follows the First

People who’ve been scammed often get contacted again, by someone offering to “recover your money” for a fee or claiming to be the police or your bank. Australia’s ACMA warns about exactly this: watch for new scams after a loss, especially someone offering to help get your money back (ACMA). The FTC says the same about fake refund callers.

A simple rule: nobody legitimate asks you to pay to get your own money back.

Making the Next Click Safer

• Go to the site yourself instead of using the link in a message. Type the address or use your own bookmark.
• Check a sender before you act. In Singapore, unregistered SMS sender IDs are tagged “Likely scam” under the SMS Sender ID Registry (SPF).
• Links arrive in other ways too: fake QR codes, fake online stores and public Wi-Fi pages. Check whether your details are already out there with our data leak guide.

Frequently Asked Questions

Can I get hacked just by clicking a link?

Usually a click opens a fake page and the harm comes from what you type in. The riskier case is a page that starts a download or asks you to install something. Keep your software updated, and if anything did install, follow the download steps above.

What if I gave my ID number or personal details?

An ID number can be used to impersonate you, so tell the organisation that issued it and report through your country’s official route above. In the US, our credit freeze guide explains one step you can take. I’m not a substitute for your bank or the authorities, and the right steps depend on what you gave away.

Should I factory reset my phone after clicking a scam link?

Not automatically. If you only clicked or typed into a web page, a reset is usually not needed. Consider one if you installed an app you can’t remove or the phone keeps misbehaving after a scan. Back up your photos and contacts first.

Over to you: have you ever tapped a scam link and realised afterwards? What gave it away, and what did you do next? Tell us in the comments. It may help another reader.

Sources

1. FTC, What To Do if You Were Scammed: https://consumer.ftc.gov/articles/what-do-if-you-were-scammed
2. Singapore Police Force and CSA, advisory on safeguarding against compromise (5 Feb 2025): https://www.police.gov.sg/media-hub/news/2025/02/20250205_advisory_on_safeguarding_against_compromise
3. Singapore Police Force, advisory on phishing scams involving emails and text messages (18 Nov 2021): https://www.police.gov.sg/media-hub/news/2021/20211118_police_advisory_on_reemergence_of_phishing_scams_involving_emails_and_text_messages
4. Singapore Police Force, advisory on phishing scams and online messaging channels (19 Dec 2024): https://www.police.gov.sg/media-hub/news/2024/20241219_police_advisory_on_phishing_scams_and_usage_of_online_messaging_channels
5. Scam.SG, support measures for scam victims: https://www.scam.sg/flag-a-business
6. UK NCSC, report a scam text message: https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message
7. Ofcom, what to do about a scam call, text or message: https://www.ofcom.org.uk/phones-and-broadband/scam-calls-and-messages/what-to-do-about-a-scam-call-text-or-message
8. City of London Police, Report Fraud service: https://www.cityoflondon.police.uk/news/city-of-london/news/2025/december/report-fraud-service-goes-live-with-full-public-launch-in-january-2026/
9. National Cyber Crime Reporting Portal and helpline 1930 (via Vikaspedia): https://en.vikaspedia.in/viewcontent/e-governance/online-citizen-services/government-to-citizen-services-g2c/cybercrime-reporting-portal?lgn=en
10. Australian Cyber Security Centre, types of scams: https://www.cyber.gov.au/learn-basics/explore-basics/watch-out-threats/types-scams
11. ACMA, phone and SMS scams: https://acma.gov.au/scams
12. eSafety, what to do if you’re a victim of a text or SMS scam: https://beconnected.esafety.gov.au/topic-library/identifying-and-avoiding-scams/text-or-sms-scams/what-to-do-if-you-re-a-victim-of-a-text-or-sms-scam
13. Canadian Anti-Fraud Centre, what to do if you’re a victim of fraud: https://antifraudcentre-centreantifraude.ca/scams-fraudes/victim-victime-eng.htm
14. Google Account Help, hacked account: https://support.google.com/accounts/answer/6294825
15. Google Account Help, see devices with account access: https://support.google.com/accounts/answer/3067630
16. Google Play Protect: https://android.com/play-protect

You Might Also Like

How to Spot a Fake QR Code: 7 Warning Signs Before You Scan Authenticator App vs SMS: Which Is Safer, and When Should You Switch? Is Public Wi-Fi Safe? What You Can Actually Do About It