Quick answer
If you clicked a phishing link, stop further communication immediately, do not enter any data and report the message. Change the password on the affected account, enable two-factor authentication and scan your device with antivirus. The sooner you act, the less damage.
How to recognize the problem
- You clicked a link in a suspicious email or message
- A page opened asking for your password or card details
- You downloaded a file or installed a program from a suspicious site
- The page looked like a known service, but the address was strange
- After clicking, unexpected windows or notifications appeared
Most common causes
Fake login page
A phishing page mimics the look of a known service (bank, email, social network) and asks you to enter your username and password. The data goes to the attacker.
Malicious attachment or download
Clicking an attachment or download button can trigger malware installation. Even if you noticed nothing, infection is possible.
Session or cookie theft
Some phishing pages steal session cookies, so the attacker can access the account without a password. That is why it is important to sign out and change the password.
Card details
If you entered payment card details, the attacker can use them immediately. You need to block the card and inform the bank.
Step-by-step fix
- 1
Stop any further action
Close the page or window that opened. Do not enter any data, do not click additional buttons and do not reply to the message. If you downloaded a file, do not open it.
- 2
Change the password on the affected account
If you entered a password, change it immediately. Sign in to the service (for example, Microsoft 365, Google, bank) via the official address, then in the account settings find the option to change the password. Use a new, unique password that you do not use anywhere else.
- 3
Enable two-factor authentication
If not already enabled, activate 2FA on that account. In the security settings look for an option such as
Two-factor authenticationand follow the instructions. This prevents sign-in with only a stolen password. - 4
Sign out of all sessions
In the account security settings find the option to sign out of all devices (
Sign out of all sessions). This cuts off any attacker access. Then sign in again with the new password. - 5
Scan the device for malware
Run a full scan of your computer using built-in antivirus (Windows Security) or a reliable antivirus program. On your phone, check in settings that there are no suspicious apps. If the scan finds threats, remove them.
- 6
Report the phishing message
In your email client look for the option to report phishing (for example, in Outlook via the
Reportoption). If the message arrived at a business account, inform the IT department. Do not forward the message further. - 7
Check financial details
If you entered card details, call the bank immediately and block the card. Then monitor transactions and report any suspicious ones. If you entered online banking details, be sure to change the password and inform the bank.
- 8
Watch for signs of abuse
In the following days watch for unexpected sign-ins, messages or notifications. If you notice anything suspicious, change the password again and check active sessions. For business accounts, inform the administrator.
If nothing helps or you suspect compromise
If even after changing the password and signing out of sessions you notice unusual activity, such as unknown devices in the session list, changed email rules or automatic replies you did not set up, contact the administrator or service support. For business accounts, the IT department can check audit logs and determine whether the attacker had access. If it is a bank account, inform the bank immediately and follow further instructions. Do not try to "clean" the account yourself by deleting all data without advice, because you may lose evidence. Always keep the original phishing message (do not delete it) until you finish reporting, as it can help the investigation.
How to prevent it
- Check the sender address and links before clicking (hover over the link to see the actual address).
- Do not enter passwords and card details on pages you reached via a link in an email.
- Enable two-factor authentication on all important accounts.
- Regularly update your browser, operating system and antivirus program.
When to call a professional
If you are on a business account or suspect the attacker gained access, contact the IT department or administrator. They can check logs faster, block access and prevent spread to other accounts.
IT infrastructure maintenance · Servers, networks, backup, security and helpdeskFAQ
Is changing the password enough?
Changing the password is the first and most important step, but it is not always enough. You also need to sign out of all sessions, enable 2FA and scan the device for malware, because the attacker may have access in other ways.
What if I only opened the phishing page and did not enter anything?
The risk is lower, but not zero. Close the page, run a device scan and watch for suspicious windows. If you did not enter data, the chance of account theft is small, but stay careful.
How do I know if my account is compromised?
Signs include unknown devices in the active sessions list, changed security settings, automatic replies you did not set up or notifications about sign-ins from an unknown location. Regularly review the account security settings.