Introduction
If you clicked a phishing link in the UK, stay calm and act in this order: stop what you are doing, disconnect the device if you can, do not enter any more details, then change your passwords from a clean device, run a full security scan, and report the message to the NCSC. If you entered bank details or lost money, contact your bank straight away. Speed matters more than embarrassment, and a quick response limits the damage.
The first five minutes: stop, disconnect, do not panic
Close the page or app that opened from the link. Do not click anything else on that page, and do not download anything it offers. If the page asks you to sign in, close it without entering details. If you already entered details, that is covered in the sections below, so keep reading rather than trying to undo it on the same page.
Disconnect from the internet if you can do it safely, for example by turning off Wi-Fi or unplugging the network cable. This stops a malicious page or download from sending more data while you work out what happened. Do not use the same device to change passwords yet if you think it may be infected. Use a different device that you trust, such as your phone on mobile data, or a second computer.
Take a screenshot of the original message, including the sender address and the link if it is visible, before you delete anything. You will need it for your report, and for your IT team or bank if they ask what happened. Then tell someone: your IT team at work, or a colleague at home who can help you work through the steps. Phishing works because it creates urgency and shame. Telling someone quickly breaks both.
If you entered a password
Change that password immediately, from a clean device, not from the device you clicked on if you suspect it is infected. Then change the password on every other account that uses the same password. This is the step people skip, and it is the step attackers rely on, because a password reused across email, banking and work systems gives them several doors for one stolen key.
Turn on two factor authentication on the affected accounts if it is not already on. Use an authenticator app where you can, rather than a text code, because app codes are harder to intercept. If the account offers passkeys, consider switching to a passkey for that account, as the NCSC suggests for accounts where a password was given away.
Check the account for changes you did not make: new forwarding rules in email, changed recovery email or phone number, unfamiliar logins, or messages sent from your account that you do not recognise. Remove any forwarding rule you did not set, sign out of all other sessions where the account offers that option, and review recent activity. If you are locked out, follow the provider’s account recovery process straight away, and do not pay anyone who offers to recover it for you.
For a lasting fix, move your passwords into a team or personal password manager with a unique password for every account. Our guide to the best password managers for small teams in the UK explains shared vaults, onboarding and offboarding, and why one strong master password beats a spreadsheet every time.
If you entered bank or card details
Contact your bank immediately, using the number on the back of your card or on the bank’s official website, not any number in the phishing message. Tell them exactly what you entered and when. They can freeze a card, block a transaction, or place extra checks on the account. The sooner you call, the more options they have.
Check your recent transactions for anything you do not recognise, and keep checking for the next few days. If money has gone, report it as a crime as well as telling your bank. In England, Wales and Northern Ireland, report fraud to Report Fraud, formerly Action Fraud, online or on 0300 123 2040. In Scotland, report to Police Scotland on 101. Keep the crime reference number and any case details your bank gives you.
Do not send money to anyone who contacts you afterwards claiming they can recover your loss, and do not click a link in a follow up message that claims to be from your bank about this incident. Go to your bank directly, through its app or its official website, for every step from here.
If you downloaded something or installed software
If you downloaded a file, do not open it again. If you ran a file, or followed instructions to paste a command or install software, run a full scan with your antivirus software and let it clean up anything it finds. The NCSC advises exactly this step when a link was opened on a computer or software was installed following a phishing message. Update your antivirus and your operating system first if an update is waiting, then run the full scan, not just a quick scan.
If the scan finds malware, follow the antivirus advice to remove it, then change your important passwords from a clean device, starting with email and banking. If you are unsure whether the device is clean, ask your IT team or a trusted local technician to check it before you use it for sensitive accounts again. Do not keep using a device you suspect is infected just because it seems to work normally. Some malware is designed to look normal.
On a phone, delete the downloaded file or app if you can identify it, update the phone software, and run a scan if your security app offers one. Check for new apps you do not recognise, changed permissions, and unusual battery or data use, and remove anything you did not install yourself.
If it was a work device or a business account
Tell your IT team immediately, whatever happened next. Do not wait to see if anything goes wrong. IT needs to know which message it was, which link you clicked, and what you entered or downloaded, so they can check whether anyone else in the business received the same message and whether any business system is at risk. A quick report protects your colleagues, not just you.
If customer data or business systems may have been exposed, treat it as a possible data breach and raise it with the person responsible for data protection in your business straight away. Under UK GDPR, an organisation that suffers a personal data breach must notify the ICO without undue delay and within 72 hours of becoming aware of it, where the breach is notifiable. That clock is one reason to report internally at once, rather than after the weekend. Your business should also assess whether affected customers need to be told, and keep a record of what happened and what was done.
Small firms can prepare for this in advance with the habits in our cybersecurity tips for remote workers in the UK, including separate work and personal devices, two factor authentication everywhere, and software updates. Prevention is cheaper than recovery, but it only works if staff know that reporting a click is safe and expected.
How to report it in the UK
Reporting helps the NCSC block the sender and take down malicious sites, and it helps the police build a picture of wider fraud patterns. Report in the right place for what happened:
First, forward a suspicious email to the NCSC Suspicious Email Reporting Service at report@phishing.gov.uk. Forward a suspicious text message free of charge to 7726, so your mobile provider can investigate the sender. Report a suspicious website through the NCSC reporting form on its website.
Second, if money was lost, an account was hacked, or financial details were shared, report it to Report Fraud in England, Wales and Northern Ireland, or to Police Scotland on 101 in Scotland, as well as telling your bank. If the message came through work, report it to your IT team first, and they can pass it on to the NCSC where that is warranted.
Third, keep the evidence. Keep the original message, the screenshot, and any reference numbers from your bank or from a fraud report. Do not forward the phishing message to colleagues or friends to warn them, because forwarding it spreads a live link. Tell them in your own words what to look out for instead.
Signs you may have been compromised
Watch for these in the days after a click: password reset emails you did not request, logins from places you have not been, messages sent from your accounts that you did not write, new email forwarding rules, unfamiliar transactions, or a device that suddenly runs slowly or shows pop ups it did not show before. Any one of these is a reason to change passwords again from a clean device and to run another full scan.
If you see signs of compromise on a work account, tell IT again, even if you already reported the original click. A second report is not a nuisance. It is how an incident gets caught early, before it spreads to other accounts or systems.
How to avoid the next one
Slow down at the moment a message creates urgency. A message that says your account will close, a payment failed, or a parcel cannot be delivered is designed to make you click before you think. Go to the service directly instead: open its app, type its website address yourself, or call a number you already know. Never use a link, number or reply address from a message you doubt.
Learn the red flags with real UK examples in our guide on how to spot a phishing email, including fake HMRC refunds, supplier bank detail changes, and boss request scams. Check the sender address carefully, hover over links without clicking them where your device allows it, and be suspicious of unexpected attachments and QR codes that lead to sign in pages.
Use a password manager, unique passwords, and two factor authentication on email and banking first, because those two accounts unlock almost everything else. Keep software updated, and make reporting easy in your household or business, so the next person who clicks tells someone in minutes, not days.
FAQs
I only clicked the link but entered nothing. Am I safe?
Probably, but do not assume it. Close the page, do not enter details or download anything, and run a security scan if anything downloaded automatically. If it was a work device, still tell your IT team, because they may want to check whether the link tried to install anything.
I clicked a phishing link on my phone. Is it different from a computer?
The steps are the same: stop, do not enter details, change affected passwords from a clean device, delete anything you downloaded, and update the phone. Phones can be targeted with fake sign in pages just as computers can, and a password entered on a phone is just as stolen.
Should I change all my passwords, or just the one I entered?
Change the one you entered first, then every account that shares that password. After that, work through your most important accounts, starting with email and banking, and give each one a unique password. A password manager makes this far easier than doing it from memory.
How long should I watch my accounts after a phishing click?
Watch closely for at least a few weeks. Check bank transactions, email activity, and account logins regularly in that period. Some attackers wait before using stolen details, so a quiet first week does not mean the incident is over.
Will reporting a phishing email get my money back?
Reporting alone does not refund a loss. Your bank is the route to stopping payments and recovering money where that is possible, so contact your bank first if money or financial details are involved, and report the fraud as well so the crime is recorded and investigated.
Conclusion
Clicking a phishing link is common, and it is recoverable if you act fast. Stop, disconnect if you can, change passwords from a clean device, scan for malware, tell your bank if money or financial details are involved, tell IT if it was a work device, and report the message to the NCSC. Then fix the root cause with unique passwords, two factor authentication, and a habit of going to services directly instead of through links in messages. The best response to a click is a quick one, followed by a calmer routine that makes the next attempt fail.
