Clicked a scam link? Do this first

If you only opened the page

Close the suspicious page. Do not sign in, enter codes or install anything. Keep the message and the time for reporting. For work-related phishing, follow your organisation's reporting process. Also check whether anything downloaded or the browser displayed a security warning.

If you disclosed a password or approved a sign-in

1. Contact IT immediately for a work or school account. For a personal account, open the service's genuine app or website yourself and secure the account. [1]
2. Change the affected password from a safe device and replace reused passwords on other services. Sessions and recovery methods may also need review. [1]
3. Also report whether you entered a device code or approved MFA. Traficom describes attacks where a code entered in a genuine Microsoft service can give an attacker access; a familiar sign-in page is therefore not enough reassurance. [2]

If you ran a file and suspect malware

On a work computer, contact IT immediately. A device with a suspected active infection should be isolated from the network to limit damage. Do not routinely shut down or clean the computer before IT assesses evidence and recovery needs. CISA describes isolation and the risk of losing volatile evidence when shutting down. [3]

If you disclosed bank or card details

Contact the bank or card issuer through a known official channel and explain what happened. Do not wait for another message from the sender. Report fraud to the police. [1]

Follow-up checks

• Affected accounts are secured and any reused passwords have been replaced.
• IT has received the sequence of events, timing and relevant message without passwords being shared.
• A potentially infected device has been assessed before reconnection.
• Watch for further contacts claiming to help with recovery.

Your checkmarks are stored only in this browser.