What to Do After Clicking a Suspicious Link on Your Phone

Clicking a suspicious link can be alarming, but it does not automatically mean that your phone, accounts or payment information have been compromised.

The correct response depends on what happened after the page opened. The risk is greater if you entered a password, provided financial information, downloaded a file, installed an application or configuration profile, granted unusual permissions or shared a verification code.

This guide explains how to assess what happened and take proportionate action on an iPhone or Android device.

Quick Action Checklist

Close the suspicious webpage.
Do not return to the link or continue following its instructions.
Identify whether you entered information, downloaded anything or installed an application.
Update your phone and applications.
Change any password entered on the suspicious page.
Review recent account activity and connected devices.
Contact your bank promptly if payment information or money was involved.
Remove unknown applications, downloads or device-management profiles.
Run Google Play Protect on Android.
Monitor accounts for unusual activity.

First: Work Out Exactly What Happened

Choose the situation that most closely matches your experience:

What Happened?	Typical Level of Concern	First Response
You opened the page and immediately closed it	Usually lower, but not zero	Update the device and monitor for unusual behaviour
You entered a password	High account risk	Change the password through the genuine website or app
You entered card or bank details	High financial risk	Contact the card issuer or bank promptly
You shared a verification code	High account-takeover risk	Secure the affected account immediately
You downloaded a file	Depends on whether it was opened or installed	Delete it and review the device
You installed an app or profile	Potential device risk	Remove it and review permissions and accounts
You allowed notifications only	Usually browser-spam risk	Remove the website’s notification permission
You sent money	Immediate financial risk	Contact the payment provider and preserve evidence

If You Only Opened the Link

If you opened the page, did not enter information, did not download anything, did not install an application and did not approve permissions, the situation may be less serious.

Take these steps:

Close the tab.
Do not reopen the message or link.
Check the Downloads folder for unexpected files.
Update the phone’s operating system.
Update the browser and installed applications.
Restart the phone.
Monitor the device and your accounts for unusual activity.

Clearing browser history may remove the page from your history, but it is not a substitute for updating the device or securing accounts.

Do Not Continue Interacting With the Page

Suspicious websites may display messages such as:

Your phone is infected.
Your account will be suspended.
A payment has been rejected.
Your photographs will be deleted.
A parcel requires a small delivery payment.
You must install a security application.
You need to call a support number immediately.
You have won a prize.

Do not press download buttons, call telephone numbers shown on the page or install software suggested by an unexpected warning.

Real security checks should be performed through your phone settings, official app store or the verified account website—not through instructions supplied by the suspicious page.

If You Entered a Password

Change the password immediately through the genuine service.

Close the suspicious page.
Open the official application yourself or manually type the known website address.
Change the affected password.
Create a password that you have not used on another account.
Review recent sign-ins and connected devices.
Sign out unfamiliar sessions.
Enable two-factor authentication when available.
Check whether recovery email addresses or telephone numbers were changed.

Do not change the password by returning to the link in the suspicious message.

Change Every Account Using the Same Password

If the compromised password was reused, change it everywhere else it was used.

Start with the most important accounts:

Email.
Banking and payment accounts.
Apple Account or Google Account.
Password manager.
Mobile carrier.
Social media.
Shopping accounts containing saved cards.
Work or school accounts.

Email should receive high priority because it can often be used to reset passwords for other services.

If You Entered Your Apple Account Details

Use Apple’s official settings or account website to regain control.

Open Settings on your iPhone.
Tap your name.
Tap Sign-In & Security.
Tap Change Password.
Follow the onscreen instructions.

Also review:

Devices connected to the Apple Account.
Trusted telephone numbers.
Primary email addresses.
Payment information.
Recent purchases.
Unknown account-recovery changes.

If you cannot change the password because someone else already changed it, use Apple’s official password-reset or account-recovery process.

If You Entered Google Account Details

Open your Google Account directly and complete a Security Checkup.

Open the genuine Google Account page.
Open Security & sign-in.
Review recent security events.
Change the password.
Open Your devices.
Select Manage all devices.
Sign out devices or sessions you do not recognise.
Review recovery email addresses and telephone numbers.
Enable two-step verification when available.

Also review third-party applications that have access to the account and remove access that you do not recognise or no longer need.

If You Shared a Verification Code

A one-time security code can allow a criminal to complete a login, password reset, payment or account change.

Act immediately:

Change the password of the account connected to the code.
Review recent account activity.
Sign out unknown devices.
Check recovery details.
Contact the service’s official support when unauthorised changes occurred.
Contact your bank when the code related to a payment or financial account.

A genuine support employee should not ask you to read out a one-time password sent to your phone for an action you did not initiate.

If You Entered Card or Banking Information

Contact the card issuer, bank or payment provider using the number printed on the card, the official banking application or a verified account statement.

Explain:

That the information was entered on a suspected phishing page.
The date and approximate time.
Which information was provided.
Whether any payment was authorised.
Whether you shared a security or verification code.

The provider may recommend:

Freezing or replacing the card.
Changing online banking credentials.
Reviewing recent transactions.
Adding additional account protection.
Disputing unauthorised payments.

Do not wait for an unauthorised transaction to appear when the complete card details or online banking credentials may have been exposed.

If You Sent Money

Contact the payment provider immediately. Some transactions may be difficult or impossible to reverse, particularly gift cards, cryptocurrency, bank transfers and payments sent to an individual.

Preserve:

The original message.
The suspicious website address.
Screenshots.
Payment receipts.
Recipient information.
Emails and chat conversations.
Telephone numbers.
Dates and times.

Do not send additional money to someone claiming that they can recover the first payment. Recovery scams often target people who have already lost money.

If a File Was Downloaded

A download is not necessarily the same as an installation, but an unknown file should not be opened.

On iPhone

Open the Files app.
Check Downloads in iCloud Drive and On My iPhone.
Identify the unexpected file.
Do not open it.
Delete it.
Check the Recently Deleted area before permanently removing it.

On Android

Open Files by Google or the device’s file manager.
Open Downloads.
Find the unexpected file.
Do not install or open it.
Delete it.
Run Google Play Protect.

Be especially cautious with files claiming to be:

A security update.
A delivery application.
A bank verification tool.
An invoice.
A refund form.
A browser update.
A package-tracking application.

If You Installed an Android App

Remove an application installed from a suspicious link or an unknown source.

Open Settings.
Open Apps.
Select the suspicious application.
Tap Uninstall.
Restart the device.

Then run Google Play Protect:

Open the Google Play Store.
Tap your profile picture.
Tap Play Protect.
Review the current status.
Run a scan when the option is available.
Follow any removal or security recommendations.

Also check whether the suspicious app received powerful permissions, including:

Accessibility access.
Device administrator control.
Notification access.
SMS access.
Permission to install other applications.
Screen overlay permission.
Contacts and call access.

Remove permissions you do not recognise and uninstall the application.

If You Installed Something on an iPhone

Normal webpages cannot silently install an ordinary iPhone app without further user interaction. However, a suspicious page may persuade someone to install an application or configuration profile.

Remove a Suspicious App

Find the application on the Home Screen or App Library.
Touch and hold its icon.
Tap Remove App.
Tap Delete App.
Confirm.

Check for an Unknown Configuration Profile

Open Settings.
Tap General.
Tap VPN & Device Management.
Review any listed profiles.
Select an unknown profile.
Tap Delete Profile.
Follow the instructions.
Restart the iPhone.

If the VPN & Device Management section does not display any profiles, no device-management profile is installed.

Do not remove a legitimate work or school profile without checking with the organisation that manages the device.

Update the iPhone or Android Device

Operating-system updates can contain important security corrections.

Update iPhone

Open Settings.
Tap General.
Tap Software Update.
Install an available official update.

Update Android

The exact route varies, but commonly:

Open Settings.
Tap System or Security & privacy.
Open the system or security update section.
Install available updates.

Also update applications through the App Store or Google Play.

Check for Unusual Device Behaviour

Investigate further when you notice:

Pop-up advertising that cannot be closed.
Unexpected applications.
Unknown device-management profiles.
The browser repeatedly redirecting to unfamiliar pages.
Rapid battery drain combined with unknown background activity.
Unexplained mobile-data usage.
Settings changing without your action.
Messages being sent from your accounts.
Unknown account logins.
Security notifications you did not initiate.
The device becoming unusually hot while idle.

One symptom does not necessarily prove malware. Compare the behaviour with recently installed applications, updates and account activity.

Review Browser Notification Permissions

Some deceptive websites ask visitors to allow notifications and then send alarming advertising messages that resemble system warnings.

If suspicious notifications continue after the webpage has been closed:

Open the browser’s site settings.
Review websites allowed to send notifications.
Remove the unfamiliar website.
Do not interact with the notification itself.

A browser notification claiming that your phone has several viruses is not proof that the device is infected.

Should You Clear Browser Data?

Clearing website data can remove cookies, saved site permissions and local browser information connected to the suspicious page.

However, it can also sign you out of legitimate websites and remove useful saved data.

More importantly, clearing browser data does not:

Change a password that you entered.
Cancel a payment.
Remove an application you installed.
Remove an unknown profile.
Secure an account already accessed by someone else.

Use it as a browser-cleanup measure, not as the only security response.

Should You Install an Antivirus App?

Android already includes Google Play Protect on supported devices. Start with Play Protect, operating-system updates and removal of suspicious applications.

Be careful with antivirus advertisements shown by the suspicious webpage itself. A scam page may attempt to frighten you into installing another unwanted or paid application.

On iPhone, applications operate under platform restrictions and cannot perform the same type of complete system scan commonly associated with desktop antivirus software. Use Apple’s built-in protections, update iOS and review installed applications, profiles and account activity.

Should You Factory Reset the Phone?

A factory reset deletes personal information and returns the phone to its initial state. It should not be the first response to merely opening a link.

Consider it only when:

Persistent malware signs remain after suspicious applications have been removed.
The manufacturer or qualified support service recommends it.
Device settings remain under unknown control.
You cannot remove a harmful application or profile.
Severe problems continue after updates and normal troubleshooting.

Before resetting:

Back up photographs, contacts and essential documents.
Confirm that you know the Apple or Google Account password.
Save authentication recovery codes.
Do not deliberately back up and reinstall a suspicious application.

What Not to Do

Do not call the telephone number shown in the suspicious warning.
Do not download the “security app” recommended by the page.
Do not share verification codes.
Do not provide remote access to the phone.
Do not pay a fee to unlock, verify or protect an account.
Do not continue using a password entered on the suspicious page.
Do not assume that closing the browser reverses information already submitted.
Do not repeatedly open the link to investigate it.
Do not forward the active link to friends without warning.

How to Report the Message or Website

Use the reporting option available in your email or messaging application.

Depending on the situation, you may also report it to:

The company being impersonated.
Your mobile carrier.
Your email provider.
Your bank or payment company.
The relevant fraud-reporting authority in your country.
Google Safe Browsing when the page is a suspected phishing site.

United States users can report suspected fraud through the Federal Trade Commission and may forward eligible spam text messages to 7726.

How to Recognise the Next Suspicious Link

Warning signs include:

An unexpected message creating urgency or fear.
A domain name that does not match the company.
A request for passwords or verification codes.
An unexpected delivery charge.
A warning that an account will close immediately.
A request to install an application outside the normal app store.
A payment request involving gift cards, cryptocurrency or transfers.
A message claiming that you won something you did not enter.
A link shortened to hide its destination.
A sender demanding secrecy.

Before entering information on an unfamiliar page, read:

How to Check if a Website Is Safe Before Buying Online

Related Phone and Security Guides

Frequently Asked Questions

Does Clicking a Suspicious Link Automatically Hack My Phone?

No. Simply opening a link does not automatically prove that the device or account has been compromised. The risk depends on the page, the device’s security status and whether you entered information, downloaded content, installed software or granted permissions.

Should I Change Every Password After Clicking a Link?

Change passwords that you entered on the suspicious page and any other accounts using the same password. You do not normally need to change every unrelated password merely because a page opened.

Can an iPhone Get Malware From a Website?

iPhone includes significant security protections, but no device should be treated as invulnerable. Keep iOS updated, avoid unknown profiles or applications and investigate persistent unusual behaviour.

Can Android Detect a Harmful App?

Google Play Protect checks installed applications and can warn about, disable or remove applications considered potentially harmful. Keep it enabled and follow its recommendations.

What if I Entered My Email Address but No Password?

Your email address alone may lead to more targeted spam or phishing attempts. Be cautious with future messages. Secure the account immediately if you also entered its password or verification code.

What if the Page Asked Me to Allow Notifications?

Remove that website from the browser’s notification permissions. Do not trust virus or account warnings delivered through those notifications.

Should I Contact My Bank if I Only Clicked?

Contact the bank promptly when you entered financial information, shared a payment verification code, authorised a payment or notice unauthorised activity. Merely opening a webpage without providing financial information does not normally require replacing a card.

Bottom Line

Start by identifying what you actually did. Merely opening a suspicious page is different from entering a password, installing an application or sending money.

Change exposed passwords through the genuine service, review connected devices, contact the bank when financial details were involved and remove unknown downloads, applications or device-management profiles.

Keep the phone updated, use Google Play Protect on Android and continue monitoring important accounts for unfamiliar activity.

Official Sources

This guide provides general risk-reduction information. Seek assistance from the relevant account provider, bank, device manufacturer or qualified security professional when unauthorised access or financial loss has occurred.