What to Do After Clicking a Phishing Link: Account Recovery and Fraud Response Plan

Overview

A phishing incident can involve several different risks: credential theft, malware, session hijacking, payment fraud, or follow-up impersonation. The right response depends on what happened after the click. Treat the event as a contained security incident until you have checked the affected accounts, devices, and transactions.

Start by recording the basics while they are fresh: the approximate time, the message or sender, the link address, the device used, what you entered, and any prompts you approved. Do not revisit the suspicious page simply to collect evidence. If the message may affect a workplace account, notify your IT or security contact immediately and follow the organization’s incident process. A quick report can help isolate a compromised account before it is used to target colleagues or customers.

Immediate decision tree

• Only opened the link: Close the page, avoid downloads or prompts, and run the device’s normal security checks. Review the browser’s recent downloads and extensions.
• Entered a password: Use a separate, trusted device if possible to change the password through the account’s official app or website. Change it anywhere else that reused the same password.
• Entered a one-time code, approved a login, or accepted an MFA prompt: Treat the account as potentially compromised. Change the password, revoke active sessions, review MFA methods, and contact the service provider through a verified channel.
• Downloaded or opened a file: Disconnect the device from networks if it behaves unusually, stop using it for sensitive activity, and contact IT or a qualified security professional. Do not delete evidence before guidance is provided.
• Shared bank, payment, tax, or identity information: Contact the relevant financial institution or provider using a trusted number or official app. Ask what monitoring, account restrictions, or replacement steps are appropriate.

For a preventive reference, see how to check if a link is a scam before you click. If the message claimed to be from a bank, verify it using the process in Bank Impersonation Scams, rather than replying to the original contact.

What to track

Recovery is easier when you track specific indicators instead of relying on memory or a general feeling that something is wrong. Create a short incident log and update it as you take action.

1. Accounts and access

• Which username, email address, or business account was exposed?
• Was the password unique, or was it reused elsewhere?
• Are there unfamiliar sign-ins, devices, locations, forwarding rules, recovery addresses, or phone numbers?
• Did the attacker create an app password, API key, connected application, mailbox rule, or new MFA method?

For email, inspect sent messages, drafts, deleted items, mailbox forwarding, and automatic rules. Attackers may use an email account to reset other accounts or impersonate the account owner. Business users should also check cloud storage sharing, administrator changes, payment instructions, and unusual messages sent to vendors or employees. The Business Email Compromise and Fake Invoice Prevention Checklist can help structure that review.

2. Devices and browser activity

• Record which device and browser opened the link.
• Check recent downloads, newly installed programs, browser extensions, and security alerts.
• Note unusual pop-ups, slow performance, disabled security tools, unexpected password prompts, or new files.
• For managed devices, preserve relevant logs and contact the administrator rather than attempting a rushed cleanup.

3. Money and identity signals

Review bank, card, payment-app, marketplace, and cryptocurrency accounts for unfamiliar activity. Look for pending as well as completed transactions, new payees, changed contact details, and password-reset messages you did not request. If sensitive identity information was shared, watch for unfamiliar account applications, verification messages, or notices about changes you did not make. Consider identity theft protection measures appropriate to your location and circumstances, and ask the affected provider which safeguards are available.

4. Evidence

Save the original message, full sender details, suspicious URL, screenshots, transaction records, and relevant timestamps. Keep copies in a safe location. Do not forward a malicious link to coworkers or friends as a warning; share the message as an attachment or use your organization’s approved reporting process when available.

Cadence and checkpoints

Use a staged schedule rather than checking once and moving on. The timing below is a practical framework; an employer, bank, payment provider, or security professional may recommend a different sequence.

First 15 minutes

1. Stop interacting with the message and close the suspicious page.
2. Disconnect a potentially infected device from Wi-Fi or wired networks if you downloaded or opened a file.
3. Change exposed passwords from a trusted device, beginning with email and administrator accounts.
4. Contact the relevant bank, payment provider, employer, or IT team through a verified channel.
5. Record the incident and preserve evidence.

First 24 hours

Revoke active sessions, review account recovery settings, confirm MFA methods, remove unfamiliar connected applications, and inspect email rules. Search for password-reset notices and sent messages. Review financial activity and ask providers about transaction disputes, account freezes, card replacement, or other available protections. Report the phishing message through the service where it arrived and to the relevant organization being impersonated. For a possible scam, use the appropriate consumer protection or law-enforcement reporting route in your jurisdiction, but do not delay urgent account or payment controls while preparing a report.

Next seven days

Check accounts and payment activity daily or at a frequency that matches the risk. Follow up with your employer, financial institutions, and service providers if promised controls have not been confirmed. Look for second-wave messages: fake support calls, delivery texts, bank impersonation, refund offers, or requests for verification codes. A phishing click can create a pretext for a later account takeover attempt.

Thirty days and beyond

Review whether passwords were truly unique, whether MFA is enabled on important accounts, and whether recovery methods are current. Remove unused applications and browser extensions. Businesses should document the root cause, confirm that affected contacts were warned, and update email, payment-change, and vendor-verification procedures. Recheck financial and identity signals periodically for as long as the affected providers recommend.

How to interpret changes

Not every unusual notification proves that an account was taken over, but several signals together should raise the priority. Treat an unfamiliar successful login, changed recovery information, missing email, unexpected MFA prompt, new payment recipient, or password-reset message as a reason to investigate immediately.

Separate evidence into three categories: confirmed, such as a transaction you did not authorize; possible, such as a login alert from an unfamiliar location; and ruled out, such as a device you later recognize. This prevents assumptions from becoming part of the incident record.

Escalate quickly when an administrator account, business mailbox, financial account, payment card, identity document, or cryptocurrency wallet is involved. Also escalate if the device downloaded a file, security controls were disabled, or the attacker may have accessed multiple accounts through password reuse. Avoid negotiating with the sender, paying a supposed recovery fee, or giving a caller remote access. Fake customer support and recovery scams often target people who have already reported a problem.

When to revisit

Revisit this response plan monthly for high-risk business or administrator accounts and quarterly for routine personal account reviews. Update it sooner when your organization changes its identity provider, payment process, remote-access tools, MFA method, or reporting workflow. It should also be reviewed after a phishing incident, a new smishing or QR code campaign, or a change in the way a bank, marketplace, or payment service communicates with users.

Reusable recovery checklist

• Record the message, URL, time, device, and information entered.
• Stop contact with the sender and do not reuse the suspicious link.
• Change exposed and reused passwords from a trusted device.
• Revoke sessions and review MFA, recovery details, connected apps, and mailbox rules.
• Check downloads, extensions, security alerts, and device behavior.
• Review bank, card, payment, marketplace, and identity activity.
• Notify your employer, IT team, bank, provider, or other affected organization.
• Preserve evidence and report the phishing attempt through appropriate channels.
• Monitor daily at first, then at a sensible weekly or monthly cadence.
• Document lessons learned and close the incident only after controls are confirmed.

Keep this checklist with your account recovery information, not in the same suspicious message thread. For related prevention work, review the website legitimacy checklist and the guidance on Amazon, PayPal, and Apple impersonation scams. A prompt, methodical response limits uncertainty and gives providers the information they need to help protect the account.