Quick answer
Contain the risk in the right order without panicking.
- Start with: Disconnect only if a download ran
- Finish with: Preserve evidence and report
- Pause if: A click alone does not always mean compromise
Primary sources for this guide: FTC: What to do after responding to phishing; IdentityTheft.gov: Report identity theft and get a recovery plan. Check the source that applies to your location and situation before acting.
Know when to escalate: If the situation involves immediate danger, suspected crime, serious health symptoms or a deadline with major legal or financial consequences, contact the appropriate local emergency service, official body or qualified professional.
A step-by-step plan
Disconnect only if a download ran
If a file installed or began running, stop using that device for account changes. A simple page visit does not always require disconnecting everything.
Change exposed credentials from a clean device
Start with the password entered on the fake page, then any account that reused it. Use a device and route you trust.
When the affected login is your mailbox, use the fuller recovery checks in How to Secure Your Email Account.
Review financial and account activity
Check sign-in history, payment activity and recovery settings. Record unfamiliar events before removing them so you can explain what happened.
Preserve evidence and report
Save the message, destination and time without revisiting the link. Report through the impersonated service and the relevant local fraud channel.
If a suspicious message is part of the problem, use the Scam Message Red-Flag Checker.
Common mistakes and warning signs
Use these checks as reasons to slow down and verify the situation. One warning sign alone does not settle every case.
- A click alone does not always mean compromise
- Do not install unsolicited cleanup tools
- Prioritize accounts by impact
Progress checkpoints
| Checkpoint | What you should have |
|---|---|
| Before acting | Disconnect only if a download ran |
| Before finishing | Preserve evidence and report |
| Reason to pause | A click alone does not always mean compromise |
Final checklist
Checklist state stays in this browser tab and is not sent to Help.You.
Sources and further verification
Rules and official processes vary by country and can change. Use the responsible organization for your location and situation. These starting points may cover a different jurisdiction.
Help.You editors structured this page around the task sequence, reviewed it for avoidable risk and checked that its claims stay within general informational scope. Read our content process.