I Clicked a Phishing Link - Here's Exactly What to Do Now (2026)

Table of Contents

Written for non-technical users. Steps verified on Windows 10, Windows 11, Android, and iPhone.

I clicked a phishing link but didn’t enter anything — am I safe?You’re likely fine, but run a scan to confirm. Simply loading a malicious page can in rare cases trigger a drive-by download on unpatched browsers. Run a full scan with Windows Defender and Malwarebytes Free. If both come back clean and you didn’t download or install anything, you’re almost certainly okay.

It happens to everyone. A message arrives that looks completely legitimate — your bank, a courier company, a friend sharing something interesting. You click before you think. A split-second later something feels wrong, and your stomach drops.

I’ve been there. And I’ve helped dozens of people through exactly this situation. The good news: most of the time, clicking a phishing link without doing anything else is far less dangerous than people fear. The panic itself often causes more harm — people start frantically clicking things, downloading “fix it” tools from random sites, or calling phone numbers that appear on screen, all of which make things dramatically worse.

Stop. Take a breath. Follow these steps in order and you will be okay.

⚡ If you’re reading this in a panic right now Close the suspicious tab if it’s still open. Do not type anything into it. Turn off your WiFi. Then follow the five steps below — in order. Do not download anything, call any number on screen, or click any button that appeared after the link.

I Clicked a Phishing Link - Here's Exactly What to Do Now (2026)

First: how risky was your click, really?

Not all phishing link clicks are equal. Your actual risk depends almost entirely on what happened after you clicked — not the click itself. Here’s a simple way to assess your situation:

Lower risk

You clicked, the page loaded briefly (or not at all), you closed it immediately, and you didn’t type anything or click any button on that page.

Medium risk

The page loaded fully, you spent time on it, but you did not enter any information, download anything, or grant any permissions.

Higher risk

You entered a username, password, or personal details. Or you clicked “Download,” “Allow,” or “Install” on something that appeared after the link.

Lower risk doesn’t mean zero risk — but it means the odds are strongly in your favour. A drive-by download that installs malware just from loading a page is possible in theory, but extremely rare on updated browsers. If your Chrome, Edge, or Firefox is current, a page loading by itself is very unlikely to cause harm.

Higher risk means act urgently — especially the steps about changing passwords.

💡 Quick check: Paste the suspicious URL into virustotal.com — it scans the link against 70+ security engines and tells you in seconds whether it’s known to be malicious. This won’t undo anything, but it tells you how seriously to treat the situation.

Do I Need Antivirus for My Chromebook? The Honest Answer

The 5 steps to take right now — in this exact order

Step 1 — Do this first, before anything else

Close the tab and don’t interact with anything on that page

If the suspicious page is still open, close just that tab — not your entire browser. Do not click any button, “X to close” popup, or “Your PC is infected — click here” message that appeared on that page. These are social engineering traps designed to get you to download something or call a fake number.

If the tab refuses to close normally, press Ctrl + Shift + Esc to open Task Manager, find your browser in the list, and click End Task. Then reopen your browser normally — your other tabs will reopen but not the malicious one.

Step 2

Disconnect from the internet immediately

Click the WiFi icon in your taskbar and select Disconnect. Or if you’re on a wired connection, unplug the cable from the back of your PC. This is a precaution that takes five seconds and costs nothing — if any malware did manage to run, cutting the connection stops it from calling home, downloading additional components, or sending your data anywhere.

You’ll reconnect in Step 3. The scan tools work offline because their virus definitions are already saved locally.

Step 3

Run a full scan with Windows Defender

Press Start and search Windows Security, then open it
Click Virus & Threat Protection
Click Scan options — do not use Quick Scan
Select Full Scan and click Scan now
Wait for it to finish — typically 30 to 60 minutes
If anything is found, click Remove, then restart your PC

While that runs, leave the internet disconnected. The scan works completely offline.

Step 4

Run Malwarebytes Free as a second opinion

Reconnect to the internet briefly for this step.

Go to malwarebytes.com and download the free version
Install it and open it — decline any Premium trial prompts for now
Click Scan, then Threat Scan, then Start Scan
If anything is found, click Quarantine and restart

Malwarebytes uses a completely different detection engine to Defender. Running both gives you far more confidence than either tool alone. I’ve seen Defender come back clean and Malwarebytes catch adware that installed itself silently — and vice versa.

Step 5

Change your passwords — but only for accounts connected to that link

If the phishing page was impersonating a specific company — your bank, PayPal, Amazon, Gmail — change your password for that account immediately, from your phone or a different device, not from the PC you’re cleaning. Assume the page was designed to capture that login even if you didn’t type anything, as a precaution.

Priority order for password changes:

Whatever service the phishing link was pretending to be
Your primary email account — it’s the master key to everything else
Online banking and PayPal
Any account where you use the same password as above

While you’re changing passwords, turn on two-factor authentication (2FA) for your email and banking accounts. Even if a hacker has your password, they cannot log in without the code sent to your phone.

Popup Says My Computer Is Infected – Scam or Real?

What to watch for over the next 30 days

Even after a clean scan, stay alert for the following over the next month. Some malware lies dormant before activating, and some credential theft takes days to be exploited.

📧Unexpected password reset emails

If you receive password reset requests you didn’t ask for, someone has your email address and is trying to break into linked accounts. Change that email password immediately.

💳Unrecognised bank transactions

Even small test transactions of £0.01 or £1 can indicate someone is verifying your card details before making larger charges. Report immediately to your bank.

📱Friends receiving strange messages from you

If contacts tell you they’ve received weird messages from your accounts, your social media or email has been accessed. Change that password from a different device immediately.

🔔Login alerts from unfamiliar locations

Most services email you when a new device logs in. Watch for login notifications from cities or countries you haven’t been to — that’s your account being accessed by someone else.

Special section: if you entered your password on that page

This is the scenario that requires the most urgent action. Phishing pages are built for one purpose: to capture your credentials the moment you type them. The page likely looked identical to the real site — same logo, same layout, same colours. That’s deliberate.

If you typed your password, treat it as compromised immediately — regardless of whether the scan finds anything.

Change the password right now from your phone, not the affected PC
Check for active sessions — Gmail, Facebook, and most banking apps show you where your account is currently logged in. Look for unfamiliar devices or locations and remove them
Enable 2FA on that account immediately — this is the single most effective thing you can do
If it was your banking password — call your bank directly using the number on the back of your card and inform them. They can flag your account for monitoring and reverse fraudulent transactions faster if they know

⚠️ One more thing: If you use the same password on other sites — which most people do, even knowing they shouldn’t — change it everywhere. Attackers run stolen credentials against hundreds of other sites automatically. This is called credential stuffing and it happens within hours of a breach.

How to stop this happening again

The phishing link that caught you was almost certainly designed by professionals. These aren’t amateur attempts — they’re carefully crafted to look exactly like messages you’d expect to receive. You are not naive for being caught. But there are habits that make you dramatically harder to fool:

Hover before you click — on desktop, hover your mouse over any link before clicking. The real destination URL appears in the bottom-left of your browser. If it doesn’t match the company the message claims to be from, don’t click.
Go directly to the website instead of clicking the link — if an email says your account needs attention, don’t click the link. Open a new tab and type the website address yourself. If there really is a problem, you’ll see it when you log in normally.
Question urgency — phishing messages almost always create artificial urgency: “Your account will be suspended in 24 hours.” Legitimate companies don’t operate this way. Urgency is a manipulation tactic.
Use a password manager — password managers only autofill your credentials on the exact domain they were saved for. If you’re on a fake PayPal page, your password manager won’t autofill — because the URL doesn’t match. This alone stops most phishing attacks dead.
Enable real-time web protection — tools like Malwarebytes Premium block known phishing URLs before the page even loads, so even an accidental click never reaches a dangerous destination.

🛡️ Stop the Next Phishing Click Before It Causes Harm

Malwarebytes Premium — blocks phishing sites before they load

The free version of Malwarebytes is great for cleaning up after an incident. But Premium adds something the free version doesn’t: real-time web protection that checks every URL you click against a live database of known phishing and malicious sites — and blocks them before the page loads. One click on a phishing link becomes a harmless blocked page instead of a security crisis.

Blocks known phishing and malware URLs in real timeWorks alongside Windows Defender with no conflictsCovers Windows, Mac, Android, and iPhone (5 devices)Stops malicious ads and drive-by downloads automatically30-day money-back guarantee — zero risk to try

Check Price on Amazon →

Affiliate disclosure: We earn a small commission on purchases through our links at no extra cost to you. We only recommend tools we’ve personally tested.

Frequently asked questions

What happens if you click a phishing link?

One of three things: nothing happens (the link was dead or your browser blocked it), you land on a fake page designed to steal your login credentials, or in rare cases malware attempts to download automatically. The outcome depends on what type of link it was and whether you entered information or downloaded anything. If you did neither, your risk is much lower — but still run a scan to confirm.

Can you get a virus just from clicking a link?

Technically yes, through drive-by downloads that exploit browser vulnerabilities — but this is rare on updated browsers. The far more common outcome is landing on a fake login page. If you did not enter any credentials and did not download or install anything, your risk is low. Keep your browser updated and run a scan to be sure.

I clicked a phishing link but didn’t enter anything — am I safe?

You’re likely fine, but run a scan to confirm. Simply loading a malicious page can in rare cases trigger a drive-by download on unpatched browsers. Run a full scan with Windows Defender and Malwarebytes Free. If both come back clean and you didn’t download or install anything, you’re almost certainly okay.

How do I know if a link was a phishing link?

Check the URL — phishing domains often misspell the real company name (paypa1.com, arnazon.com). The page likely asked urgently for login credentials. The original message had unusual urgency, odd grammar, or came from an unexpected sender. You can paste any suspicious URL into virustotal.com to check it against 70+ security engines for free.