Skip to content
IT

I clicked a scam link: what to do in the first two hours

You clicked, maybe you even typed your details, and now your heart is racing. Stop for a minute: in most cases this is fixable. Here is what to do, in order, starting with the most urgent.

Andrea Bissi · · 5 min read

Cyber for Humans
Level
principiante
Time
30 minutes
What you need
The phone or computer you used, and your payment card to hand

It happens to everyone, and it mostly happens when you are in a hurry. A text about a parcel, an email from the bank, a message that looks like it is from your daughter. You clicked. Maybe you stopped halfway, maybe you typed something in.

For now, know that clicking on its own is almost never enough to cause damage. The trouble comes from what happens next, from the details you typed into the page or from an app you installed. So breathe, and do these things in this order.

In plain words

Phishing (from fishing: the scammer casts the hook and waits): a fake message imitating a real sender, your bank, the post office, a courier, to get you to type your credentials into a page that looks like the real one. Credentials: username and password, plus the codes that arrive by text.

If you only clicked, and typed nothing

This is the most common case, and the least serious one too. The page opened, you realised it was fake, you closed it.

  1. Close the tab and do not go back.
  2. On a computer, run a scan with the antivirus you already have (on Windows: search for "Windows Security", then Virus & threat protection, Quick scan).
  3. If a file downloaded in the meantime, delete it without opening it, and empty the bin.
  4. You do not need to change passwords. You do not need to wipe anything.

If you typed your credentials

Time matters here, because you need to get there before they do.

  1. Change that service's password straight away, but not from the link in the message: open the app yourself, or type the address into the browser yourself.
  2. Change the same password everywhere you reused it. It is the step almost everyone skips, and meanwhile whoever has your password for one site is trying it on all the others, starting with your email.
  3. Start with the email account. Anyone who gets into your inbox can reset the password for everything else, so if time is short, secure that one first.
  4. Turn on two-step verification wherever you had not: from then on a stolen password alone is no longer enough. We have a step-by-step guide.
  5. In the service's settings look for "connected devices" or "active sessions" and sign out of everything. Then sign back in yourself.

If you entered your card details

  1. Freeze the card. It takes thirty seconds in your banking app, searching for "block card". If you cannot, call the number printed on the back of the card, not one you found on the internet.
  2. Look at the last few days of transactions. Note the date, time and amount of anything you do not recognise.
  3. Ask to dispute the transactions, which is the formal procedure for contesting the charges. Your bank will tell you how, usually a form in the app or in branch.
  4. Ask for a replacement card. Treat the old number as burned.
Relax:

For unauthorised payments, European rules require the bank to refund you except in cases of gross negligence by the customer. Reporting immediately and in writing puts you on the right side of that. And do not be put off by the first "no" over the phone: the claim has to go in writing.

If you installed an app or gave access to your phone

This is the most serious situation. It is typical of the fake technician or fake bank-operator scam that asks you to install a program for “support”.

  1. Put the phone in aeroplane mode: it cuts off any connection in progress straight away.
  2. Uninstall the app: press and hold it on the screen and choose Uninstall. On Android check Settings > Apps too, because sometimes it does not show on the home screen.
  3. On Android also look at Settings > Accessibility and, by searching for "admin" with the magnifier at the top of Settings, at Device admin apps: remote-control tools hide there. Revoke permissions for anything you do not recognise.
  4. Restart the phone, then change your passwords as in the section above, using a different device.
  5. If you still do not feel safe, a factory reset is the definitive guarantee, and it is the reason having a backup matters more than all the rest.

Then, calmly: report it

Reporting is a different thing from filing a criminal complaint, and it takes a few minutes. It really does help, because scam campaigns get shut down when enough people report them.

In Italy you can do it on the Postal Police website, in the report online section. If you have actually lost money, then a complaint does need filing, and it is also the document your bank will ask for.

Our Where to check page lists the useful addresses, including the CERT-AGID weekly bulletin of scams circulating in Italy. Very often the message you received is in there, and seeing that it happened to thousands of other people helps more than you would think.

The verdict

Clicking is not the end of the world. In the two hours that matter there are only a few things to do: change your email password before any other, freeze the card if you typed it in, remove any app a stranger got you to install. Once those are done, the rest can be sorted calmly.

How to avoid the next one

One signal gives away almost all of these messages: they ask you to do something urgent, starting from a link. No bank, no postal service and no courier works that way. So the rule that always holds is to close the message and reach the service on your own, from the app or by typing the address by hand.

If you want to train your eye, I wrote how to spot a scam text message.

Sources

More in Cyber for Humans