I clicked on a scam link: what now?

Don't panic: it depends on what you typed in.

The answer in 2 lines. Don't panic: what to do depends on what happened after the click. Typed nothing: close the page. Typed a password: change it now, everywhere you use it, and turn on two-step verification. Typed card or bank details: call your bank at once on 159 or the number on your card and block the card. Installed a file or app: disconnect the device from the internet and get it checked. Then forward the text to 7726 or the email to report@phishing.gov.uk.

The first 3 steps

Close the page and don't type anything else.
Work out what you gave away: nothing, a password, card or bank details, a code sent by text, ID documents, or a downloaded file or app.
Follow the matching step below, straight away.

What to do, depending on what you did

Only opened the page: close it. The risk is low if you typed nothing and downloaded nothing. Keep your device up to date.
Typed a password: change it now, on that account and any other account that uses the same one. Turn on two-step verification (2SV).
Typed card or bank details: call your bank on 159 or the number on the back of your card, block the card and watch your account.
Gave a code sent by text: call your bank or the service at once. The code may have let someone in.
Sent ID documents: keep a note, watch for credit applications in your name and report it to Report Fraud.
Installed a file or app: disconnect from wi-fi and mobile data, remove the app, and run your security software. Change passwords from another, clean device.

What not to do

Waiting to see money leave your account before acting.
Changing your passwords on a device where you just installed a suspicious app: use another device.

In the days that follow

Check your bank statements and the login alerts on your accounts.
Be wary of follow-up calls: a fake "bank" may use your stolen details to call you. Hang up and call 159.
If money was taken, tell your bank and report it to Report Fraud (or Police Scotland on 101 in Scotland).

Report the link

A text: forward it to 7726, free on most networks.
An email: forward it to report@phishing.gov.uk.
A scam website or advert: report it through the National Cyber Security Centre, via GOV.UK.

Good to know

A payment you did not authorise should normally be refunded by your bank, unless it shows you acted with gross negligence.
If you were tricked into sending money yourself, you may still get it back under the UK reimbursement rules for scams (see our guide on fake bank calls).

In Birmingham, Sam clicks on a text saying a parcel is waiting and types in his card details before he realises. He calls 159 to reach his bank and cancels the card, then forwards the text to 7726. Two days later, a "bank adviser" calls asking for a code: Sam hangs up.

A made-up story, for illustration.

Useful numbers and contacts (UK)

159: the Stop Scams UK number that puts you through to your own bank's real fraud team (most major banks take part).
7726: forward a scam text here, free on most UK networks.
report@phishing.gov.uk: forward a scam email here (National Cyber Security Centre).
Report Fraud: the national police reporting service for fraud and cybercrime in England, Wales and Northern Ireland, which replaced Action Fraud, at reportfraud.police.uk.
101: police non-emergency number. In Scotland, report fraud to Police Scotland on 101.
999: only if a crime is happening now or someone is in danger.

Bobby

Sources, verification, confidence

Verified on 18 October 2026, for England. Confidence: high for the safety steps and the reporting channels (NCSC, GOV.UK, Stop Scams UK); medium for refund outcomes, which depend on each case. This guide describes common cases, not a diagnosis or legal advice.