🚨 I Clicked a Scam Link — What Do I Do Now?

First things first: you did nothing wrong. That sinking feeling in your stomach right now? Millions of smart, careful people feel it every year. Scammers do this for a living — it's their full-time job to fool people. What matters isn't that it happened. It's what you do in the next ten minutes. Let's do that together.

Step 1: Stop. Just... stop.

The scammer's entire game is momentum. They need you clicking, calling, panicking — moving too fast to think. So we're going to break that right now:

• Close the website, the text, the email. All of it.
• Don't call any number in the message. That's their number, not the bank's, not the government's.
• Don't reply to the text — not even "STOP." Any reply tells them your number is live, and they'll sell it to other scammers.
• Don't download anything the page is begging you to install. That "security update" is the actual virus.

Done? Good. The bleeding has stopped. Everything from here is cleanup, and cleanup is very doable.

Step 2: Be honest about what you shared

No judgment here — just pick the one that fits, because what you do next depends on it:

• Clicked the link, typed nothing. Deep breath — you're almost certainly fine. Clicking alone rarely does damage. Skip to Step 5, report it, and you're done.
• Typed in a username and password. Okay — head to Step 3. We fix this in about three minutes.
• Entered bank or card details. This is the urgent one — jump to Step 4 right now, don't finish reading first.
• Downloaded a file, or let someone "fix" your computer remotely. Turn off your Wi-Fi, do Step 4, then get the device checked by someone you already trust — a family member, or a repair shop you've used before. Not anyone who calls you about it.

Step 3: You gave them a password — change it now

Three minutes, that's all this takes:

1. Grab a different device if you can — your phone instead of the computer, or the other way around.
2. Type the real website address yourself. Your bank's site, gmail.com, whatever it was. Type it letter by letter. Never touch a link from that message again.
3. Change the password. Then change it anywhere else you used the same one — and yes, most of us reuse passwords, no shame in it, just fix it now.
4. Turn on two-factor authentication while you're in there — look under "Security" in your account settings. It means they text you a code at login, so a stolen password alone gets them nothing.

Step 4: You gave them bank or card info — call your bank TODAY

Don't "wait and see." Don't check tomorrow. Do this now.

1. Flip over your bank card. Call the number printed on the back. That's the real number — burned into plastic, can't be faked by a text message.
2. Ask for the fraud department. Then just say it plainly: "I entered my account information on a website I now believe was a scam." That's it. You don't need a speech.
3. Let them take the wheel. They may issue a new card number or freeze the account temporarily. That's not punishment — that's them doing their job, and they do this dozens of times a day.
4. Watch your statements for the next few weeks. Anything you don't recognize — call about it. That's what the fraud department is for.

Here's something worth knowing: banks deal with this constantly. You are not going to shock anyone, and nobody is going to lecture you. The people who get hurt worst are the ones who wait three weeks out of embarrassment. You're already ahead of them by acting today.

Step 5: Freeze your credit (free, takes 10 minutes, undo anytime)

A credit freeze is like a deadbolt on your financial identity — nobody can open a new account in your name while it's on. It's free by federal law, it doesn't touch your credit score, and you can lift it whenever you want (say, when you're applying for a loan). One call or website visit each, three bureaus:

• Equifax: equifax.com or 1-800-525-6285
• Experian: experian.com or 1-888-397-3742
• TransUnion: transunion.com or 1-800-680-7289

Only have energy for one thing today? Ask any one of them for a fraud alert instead — it's free, lasts a year, and they're legally required to tell the other two. Lenders then have to verify it's really you before opening anything new.

Step 6: Report it — this part protects strangers

Reporting feels pointless in the moment. It isn't. Every report feeds the systems that block these numbers, flag these sites, and eventually catch these people. Five minutes:

• Scam text? Forward it to 7726 — that's S-P-A-M on your keypad. Your carrier uses these to shut the scammers down.
• File with the FTC: ReportFraud.ftc.gov. The government's official reporting site. Straightforward, no account needed.
• Lost money? Also file at ic3.gov — the FBI's Internet Crime Complaint Center.
• Social Security or Medicare was involved? Their fraud hotline: 1-800-269-0271.

Step 7: Tell someone. Skip the shame.

This is the hardest step on the page, and the most important one after calling your bank.

Scammers need your silence. A quiet victim doesn't warn their friends, doesn't get help checking their accounts, doesn't report the number. Shame is part of the scam — it's the lock on the door after they've robbed the house.

So here's the truth, with numbers attached: Americans over 60 lose billions of dollars to scams every single year. Not thousands of people — millions. Teachers, engineers, retired police officers. People who'd never fall for anything, until the one Tuesday morning they were tired, or worried, or just not expecting it.

You don't need a big speech. Try this: "Something happened I want you to know about, so we can both watch out for it." In our experience, families aren't angry — they're relieved you told them before it got worse.

Your 10-minute checklist

1. ☐ Stopped — closed everything, didn't click, call, or reply further
2. ☐ Changed any passwords I typed in (on the real site, typed by me)
3. ☐ Called my bank's fraud department (number on the back of my card)
4. ☐ Froze my credit — or at least placed a fraud alert
5. ☐ Forwarded the scam text to 7726
6. ☐ Reported at ReportFraud.ftc.gov
7. ☐ Told someone I trust

Seven boxes. If you checked the first three, the worst is already behind you.

Sources: Federal Trade Commission (ReportFraud.ftc.gov); FBI Internet Crime Complaint Center (ic3.gov); Social Security Administration (ssa.gov). Last updated October 2026.