Quick answer: If you clicked a phishing link but didn’t type anything, close the page, report the message, and delete it. You’re most likely fine. If you entered a password, card number, or Social Security number, act on that right away: change the password or call the company, then report the scam.
Can clicking a phishing link hurt my phone?
Usually, the tap itself isn’t the real problem. What matters is what happens next. The FTC says scammers use fake emails and texts to try to steal your passwords, account numbers, or Social Security numbers.
That’s why the link usually leads to a page that looks like your bank, a delivery company, or a streaming service. It asks you to “log in” or “confirm” something. The page is a trap. A few phishing pages also push you to download an app or file. That’s less common, but it’s the reason we’ll check your apps later in this guide.
What if I only clicked and didn’t type anything?
Then you’re in the best spot you could be in. Close the tab or browser. Don’t tap anything else on the page, and don’t call any phone number it showed.
Next, report the message (we’ll cover how below) and delete it. You don’t need to change every password you own. Just keep an eye on your accounts for the next few weeks. One exception: if the message pretended to be a company you really use, like your bank, log in to that account yourself. Type the web address or open the real app. Don’t use any link from the message.
What if I entered my password, card number, or Social Security number?
Your next move depends on what you shared. Here’s a quick guide:
| What you entered | What to do |
| A password | Change it on the company’s real site or app. If you use the same password anywhere else, change it there too. |
| A credit or debit card number | Call the number on the back of your card. Ask about blocking the card and getting a new one. |
| A bank account number | Call your bank using the number on your statement or card, not the one in the message. |
| Your Social Security number or other ID details | Go to IdentityTheft.gov. The FTC says to use it if you think a scammer has your Social Security, credit card, or bank account number. |
| A verification code (the 6-digit text) | Treat the account as hacked. Change that account’s password right away. |
On an iPhone, you can change your Apple Account password in Settings. Tap your name (Apple Account), then Sign-In & Security, then Change Password. Apple says you might have to wait an hour before changing it or other critical security settings. When you set a new password, make it one you’ve never used anywhere else. Turn on two-factor authentication if the account offers it.
What should I check on my iPhone or Android?
This step matters most if the link asked you to install something, or if the page said your phone was “infected.”
On Android: Open Settings, then Apps, then See all apps. Scroll through the list and look for anything you don’t remember installing. Then open the Google Play Store, tap your profile icon, and open Play Protect. Google says Play Protect checks your device for harmful apps from other sources and may remove them. Tap Scan to run a check.
On iPhone: Look through your home screen and App Library for apps you didn’t download. Then go to Settings, General, VPN & Device Management. If you see a profile you don’t recognize, that’s a red flag.
If you find something strange on either phone, delete it. If you can’t remove it, or you’re still worried, a phone store or your carrier can check it with you.
How do I report a phishing text or email in the U.S.?
Reporting takes a minute and helps shut down the scam. The FTC gives three options:
- Phishing text: Forward it to 7726 (it spells SPAM).
- Phishing email: Forward it to the Anti-Phishing Working Group at reportphishing@apwg.org.
- Any phishing attempt: Report it at ReportFraud.ftc.gov.
If the message pretended to be your bank or another company, you can also tell that company so it can warn other customers. Report first, then delete the message.
Step-by-step: what to do
- Close the page. Don’t type or tap anything else on it.
- Don’t reply to the message or call any number in it.
- Think back: did you enter a password, card number, bank number, Social Security number, or code?
- If you entered a password, change it on the real site or app. Change it anywhere else you reused it.
- If you entered card or bank details, call the number on your card or statement.
- If you entered your Social Security number, go to IdentityTheft.gov.
- Check your phone for apps or profiles you didn’t install. Remove anything strange.
- Forward the text to 7726 or the email to reportphishing@apwg.org, and report it at ReportFraud.ftc.gov.
- Delete the message.
- Check your bank and card statements over the next few weeks for charges you don’t recognize.
Common mistakes to avoid
- Calling the phone number or tapping the “support” button on the fake page.
- Installing a “cleaner” or “security” app because a pop-up told you to.
- Reusing your old password with one small change.
- Skipping the report because “nothing happened.”
- Deleting the message before you report it.
- Assuming you need a factory reset after a click alone.
Frequently asked questions
Can scammers take over my phone just because I tapped a link? It’s unlikely when you only opened the page. The bigger risks are typing in your information or installing something the page pushes you to download. That’s why the steps above focus on what you shared and what’s on your phone.
Do I need to buy an antivirus app? Not because of one click. Many online guides come from security companies that sell antivirus products. On Android, Google’s built-in Play Protect can scan your apps for free. Focus first on passwords, card details, and reporting.
Will I get more scam texts now? Possibly. Some people report more messages after tapping, but we couldn’t find an official source confirming this. Forwarding scam texts to 7726 and blocking the number are good habits either way.
Final thoughts
Act on what you shared, not on what you tapped. If you gave nothing away, report the message and move on. If you did, change the password or call the company first, and everything else can wait an hour.