I clicked a link in a scam text. Now what? A step-by-step checklist

It happens to smart people every day. The FTC says Americans lost $470 million to scams that started with a text message in 2024 alone (FTC). The good news: what happens next depends mostly on what you did after tapping — and there's a lot you can still fix.

Step 1: Figure out what you did

Only opened the page and closed it? Low risk. Close the tab, clear your browser history, and jump to step 5.
Typed a card number? Go to step 2.
Typed a password? Go to step 3.
Typed a code your bank texted you? Call your bank right now, then step 3.
Downloaded or installed something? Go to step 4.

Step 2: Card details

Call the number on the back of the card. Say the card was compromised in a phishing scam and ask for a new number. Watch your statement for small “test” charges over the next weeks — scammers often try $1 first.

Step 3: Passwords

From a different, trusted device:

Change the password on the account you typed it into.
Change it everywhere else you used the same password — especially email.
Turn on multi-factor authentication (an authenticator app is better than text codes).
In your email settings, check for forwarding rules or recovery addresses you didn't add. Attackers set these up to keep watching.
Sign out of all other sessions (Google, Microsoft, and Apple all have this option).

Step 4: Anything installed

Computer: disconnect from Wi-Fi and have it checked before you log into anything. Malware can capture what you type.
Android: look for newly installed apps, especially anything asking for Accessibility or Device admin permission. Remove it.
iPhone: if you installed a profile (Settings → General → VPN & Device Management) you don't recognize, remove it.

Step 5: Report it

Forward the text to 7726 (SPAM) and delete it.
If you lost money, report to ic3.gov and your local precinct. Keep a record for your bank.

Step 6: Prevent the next one

Real E-ZPass NY texts come only from 39769. Real Con Ed doesn't take gift cards or Zelle. Real NYC DOF doesn't text payment links.
Never pay anything from a link in a text. Type the official site yourself.
Turn on your phone's spam filtering (Filter Unknown Senders on iPhone; Spam protection in Google Messages).

When to call a tech

If you're not sure what got typed where, or a computer was involved, call us. We'll check the device, lock down the accounts in the right order from a clean machine, and tell you exactly what to say to your bank. Same day, remote or on-site.