I Clicked a Phishing Link on My Phone: What Should I Do Right Now?

Quick answer: if you only opened the page, close it and type nothing; the risk is low but not zero. If you entered a password, change it from another device and turn on two-step verification. If you entered card or bank details, call your bank now. If you installed something or approved a profile, remove it and check your accounts.

You don’t need to panic, and you don’t need to work out everything at once. Most people who tap a scam link only end up on a fake page. What matters is what happened after the tap. This guide sorts you into one of five situations and gives the steps in order, for iPhone and for Android.

Find your situation in 30 seconds

What happened after you tapped	How urgent (our rough read)	Do this first	Then
I only opened the page and typed nothing	Low	Close the page, don’t reply	Report the message, watch for follow-ups
I typed a password or a code	High	Change that password from another device	Turn on two-step verification, check sign-in activity
I typed card or bank details	Urgent	Call your bank or card issuer	Ask for a new card, watch your statements
I downloaded a file or installed an app	High	Don’t open it; uninstall it	Check for unknown apps, update, change passwords
I approved a permission, profile, or setting	High	Remove the profile or permission	Check accounts and devices

The “how urgent” column is our own rough ranking, not an official score. If you are between two rows, follow the more urgent one. Work through the steps in order and stop when you’ve done everything in your row.

First, for every situation

1. Close the page. Close the tab or the app that opened it. Don’t tap buttons, pop-ups, or “verify” prompts on it.
2. Don’t reply to the message, even to say “stop”. Ofcom, the UK communications regulator, says not to reply, even to opt out.
3. Keep the message for now. Note the sender’s number, because you will use it to report the scam. Delete it after you have reported it.
4. Leave your accounts alone until you know your situation. Then use the row above.

If you only opened the page

Usually nothing bad happens from loading a page alone, but don’t take that for granted. The FTC says that even opening a link in an unexpected text or email can expose you to scammers, even if you don’t enter anything. The NCSC, the UK government’s cyber agency, adds that browsers block many known phishing sites, but that is not always the case on mobile devices.

Do this:

1. Check your downloads and your Home Screen or app list. Did anything download or install? If so, go to the downloaded-something section below.
2. Make sure your phone is up to date. On iPhone, go to Settings > General > Software Update. On Android, go to Settings > System > Software updates; on newer versions, security updates are under Settings > Security & privacy > System & updates. Menu names vary by maker.
3. Report the text (see the reporting section) and delete it.
4. Expect more scam messages. If one asks you to act fast, pay, or “confirm” something, it’s the same scam.

Our guide on spotting suspicious links before you click shows how to read a link’s real address, and how to stop spam calls on iPhone covers the calls that often follow a scam text.

If you typed a password or a code

Treat that password as public. The sooner you change it, the less time a scammer has to use it.

1. Change the password on the real site or app. Type the address yourself or use the official app, not the link in the message. If you can, use a different device first. This is our advice: if something has been installed on your phone, a different device is safer.
2. Change it everywhere you reused it. The NCSC says to change the passwords of any account that uses the same password. A passkey is an option where the service offers one.
3. Turn on two-step verification (also called two-factor authentication). With it, a stolen password alone doesn’t let someone in.
4. Check the account’s sign-in activity, using the steps below.
5. Never share a verification code. If a message or caller asks for the code you were just sent, it’s a scam.

Apple Account on iPhone

Apple says that if you might have entered your password on a scam website, you should change your Apple Account password immediately and make sure two-factor authentication is on.

1. Open Settings, tap your name, then Sign-In & Security, then Change Password.
2. If other devices are signed in, tap Remove Other Devices to make them sign in again.
3. Back in Settings, tap your name and scroll down to the list of devices. Tap any device you don’t recognize, then tap Remove from Account.

Google Account on Android

1. Go to your Google Account, then Security & sign-in, and open Recent security events. Tap No, it wasn’t me on anything you don’t recognize.
2. Open Your devices, then Manage devices, and sign out of devices you don’t recognize.
3. Change your password and turn on 2-Step Verification.
4. If you can’t sign in, use Google’s account recovery page.

For other accounts, such as email, social media, or shopping, look for “security”, “sign-in activity”, or “devices” in the account settings.

If you typed card or bank details

1. Call your bank or card issuer straight away. Use the number on the back of your card or your bank’s official app, never a number from the message. Ask them to block the card and any payment you didn’t make. In the UK, the NCSC says to contact your bank immediately, and you can often cancel a card online. Ofcom says that, where your bank supports it, you can call 159 to be connected to your bank.
2. Ask for a replacement card and check your recent transactions line by line for anything you don’t recognize.
3. Change your online banking password from another device, and turn on any extra sign-in step your bank offers.
4. In the US, if you shared a Social Security, card, or bank account number, the FTC says to go to IdentityTheft.gov for a step-by-step recovery plan.
5. If you lost money, tell your bank and report it as a crime. In England, Wales, and Northern Ireland, that means Report Fraud (reportfraud.police.uk or 0300 123 2040). In Scotland, call Police Scotland on 101. In the US, report at reportfraud.ftc.gov.

If you downloaded or installed something

This is the situation where the phone itself may be affected, so slow down and go in order.

1. Don’t open the file or app. If it is already open, close it.
2. Cut the connection if you can’t remove it right away. Turning off Wi-Fi and mobile data stops an app from talking to anyone while you work. This is a common-sense step, not something the sources below require.
3. Remove it, using the steps for your phone.
4. Update your phone, then change your passwords from a different device. Start with email and banking.
5. Check your accounts using the steps in the password section.

iPhone

Apple says to install software only from the App Store or directly from the developer, and warns about apps that ask you to install configuration profiles, which can then control your device.

1. Swipe left past your last Home Screen page to open App Library, then tap the search field. You’ll see an alphabetized list of every app.
2. Touch and hold any app you don’t recognize, then tap Delete App.
3. Restart the phone.

Android

Google’s advice for removing unsafe software starts with Google Play Protect.

1. Open the Play Store, tap your profile icon, then Play Protect, then Settings, and make sure Scan apps with Play Protect is on. If you have installed apps from outside the Play Store, Google suggests turning on Improve harmful app detection. Then run a scan.
2. Go to Settings > Apps (on some phones Apps & notifications), tap See all apps, and open any app you don’t recognize, didn’t get from the Play Store, or don’t trust. Tap Uninstall.
3. Google says that if signs of unsafe software continue, you can contact your device manufacturer or reset the phone to factory settings. Back up what you need first.

If a file was downloaded but never opened, delete it from your Downloads folder. On Android, also turn off the “install unknown apps” permission for the app you used, as explained in the next section.

If you approved a permission, profile, or setting

Some scam pages don’t steal a password at all. They ask you to approve something: a configuration profile on iPhone, an app that asks to install other apps, or an app that asks to administer your phone.

iPhone: look for an unknown configuration profile

Apple says to check Settings > General > VPN & Device Management. If you don’t see any profiles, no management profiles are installed. If you see one you didn’t set up and that isn’t from your school or employer:

1. Tap the profile, then tap Delete Profile, and follow the on-screen steps.
2. Restart your iPhone.

Deleting a profile also deletes the settings, apps, and data tied to it. If your phone belongs to a school or business, check with your administrator before deleting anything.

Android: unknown apps and device admin apps

1. Open Settings > Apps > Special app access > Install unknown apps. Tap any app listed as allowed, such as your browser or a file manager, and turn off Allow from this source. (Google’s Pixel help gives this path; menu names differ on other phones.)
2. Open Settings > Security and look for Device admin apps under the advanced settings. Google describes this as the place to find or remove apps that can administer your phone. Remove any you don’t recognize.
3. Open Settings > Apps, tap an app you’re unsure about, then Permissions to see what it can use, and set anything it doesn’t need to Don’t allow. If you don’t know the app, uninstall it instead.
4. Check your Google Account activity as described above.

How to report a phishing message

Reporting is free, takes about a minute, and helps get scam senders blocked.

Forward the text to 7726. It works in the UK and the US and spells SPAM on a keypad.

• iPhone: touch and hold the message bubble, tap More, tap the forward arrow, enter 7726, and send. Your provider may then ask for the sender’s number.
• Android: touch and hold the message, tap the three dots, tap Forward, enter 7726, and send.

Also report it in your messaging app. On iPhone, tap Report Junk, or swipe left on the message and choose Delete and Report Spam. In Google Messages, touch and hold the conversation, tap Block, then Report spam.

UK: email a screenshot of the scam text or QR code to report@phishing.gov.uk (NCSC). If you lost money or were hacked, report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 (England, Wales, and Northern Ireland), or call Police Scotland on 101.

US: report at reportfraud.ftc.gov. The FTC says it can’t accept forwarded messages, so paste the text into the report and don’t click the link. If the message pretended to be Apple, Apple asks you to email a screenshot to reportphishing@apple.com.

When to get more help

Contact your phone maker, your carrier, or someone you trust if you still see pop-ups you can’t remove, apps you didn’t install, or messages you didn’t send after you’ve worked through your row above. If the message came to a work phone, tell your IT department; the NCSC says to do the same.

Sources checked

We read these official pages on 2026-10-28. Menu names change between versions, so if your phone looks different, search the Settings app for the setting name.

• Apple Support, Recognize and avoid social engineering schemes, published June 15, 2026.
• Apple Support, Review and delete configuration profiles, October 2025.
• Apple Support, Change your Apple Account password and Review devices signed in to your Apple Account.
• Apple Support, Review and delete apps.
• Apple Support, Update iPhone.
• NCSC, Phishing scams: report a scam text message and If you’ve shared sensitive information.
• NCSC, Phishing attacks: defending your organisation, reviewed February 13, 2024.
• Ofcom, What to do about a scam call, text or message.
• FTC Consumer Advice, How to recognize and avoid phishing scams and Don’t take the bait on phishing scams; ReportFraud.ftc.gov FAQ.
• Google Account Help, Remove malware or unsafe software and Secure a hacked or compromised Google Account.
• Google Pixel Phone Help, Manage security & privacy settings and Download apps to your Pixel phone; Android Help, Change app permissions.

A way to check links earlier

Disclosure: BlueHammer Security is our product. It can scan QR codes and links, which is one way to check a link before you open it, though it can’t undo anything after a tap. You can read more on the BlueHammer Security page.