Something has happened
Clicked a suspicious link? Start with what happened next.
Do not panic. Opening a page is not the same as entering information, installing software or sending money. Choose the situation that is closest to yours.
Only opened the page
Close it, then stay alert.
If you did not enter information, download a file or install software, the National Cyber Security Centre says it is unlikely that you need to take further action.
- Close the page and do not return through the message.
- Watch for unexpected password-reset emails, sign-in alerts or follow-up contact.
- Check the claim through the organisation’s official app or a web address you already trust.
Entered information
Protect the affected account or payment route.
Password or login details
Open the real website or app yourself and change the password. Change it anywhere else it was reused. Start with your email account if that password was exposed.
Card or bank details
Contact your bank immediately through its official app, the number on your card or a trusted website. Explain exactly what you entered.
One-time passcode
Contact the account provider promptly. Review recent sign-ins, payments and security changes through the genuine service.
Personal or identity details
Write down what was shared and keep the message and website address. Watch the affected accounts and official correspondence for signs of misuse.
Downloaded or installed something
Check the device before using sensitive accounts.
- Open your antivirus or device-security software and run a full scan. Allow it to deal with anything it finds.
- If you followed instructions to install remote-access software, do not let the caller or sender reconnect.
- Use another trusted device for urgent banking or password changes if you are not confident the original device is safe.
- If it is a work device, tell your IT or security team promptly — even if nothing unusual is visible.
Sent money
Contact the bank or payment provider now.
Use an official app, the number on your card or a trusted website. Say that the payment may be fraudulent and ask what can be stopped or recovered.
Keep payment references, wallet addresses, messages and screenshots. Do not pay anybody who later promises recovery for an upfront fee.
Report through the right route
The message, website and crime are different reports.
- Suspicious emailForward it to report@phishing.gov.uk.
- Suspicious textForward it to 7726 free of charge.
- Suspicious websiteUse the NCSC scam-website report.
- Money lost or account hackedUse Report Fraud in England, Wales or Northern Ireland. In Scotland, contact Police Scotland.
Sources checked
- National Cyber Security Centre — phishing response and recovery
- GOV.UK — report internet scams and phishing
- Stop! Think Fraud — phishing email guidance
Reviewed 29 August 2026. Cleverways summarises these sources in plain English; follow the source organisation’s current instructions where they differ.