Clicked a link?
Do this.
It happens to careful people every day. The scam was built to catch someone in a hurry. What matters now is the next few minutes.
Close the page and don't type anything else. Clicking isn't the problem, waiting is. If you move now, most of this can be stopped.
Then find what happened: I typed a password · I gave card or bank info · I opened a file · I gave my Social Security number
What happened?
I typed a password
- Go to the real site yourself (type the address, don't use the link) and change that password, from another device if you can.
- Change it anywhere else you used the same one.
- Turn on two-step login for that account.
- If it was your email: check that your recovery phone and backup email are yours, sign out devices you don't know, and look for forwarding you didn't set up.
I gave card or bank info
- Call the number on the back of your card, never a number from the message. Tell them what happened.
- Ask them to cancel the card and watch for charges.
- Sent money, a wire, or gift cards? Call your bank or the gift card company right away. Speed is what gets money back.
I opened a file or let someone "remote in"
- Turn off Wi-Fi or unplug the internet cable.
- At work, tell your boss or whoever handles your computers now. Don't wipe or reset it yet, they may need to look at it.
- At home, run your security scan and install any updates it offers.
- From a different device, change the passwords for your email and bank.
I gave my Social Security number
- Go to IdentityTheft.gov. It builds a step-by-step recovery plan for you.
- Freeze your credit at all three bureaus (Equifax, Experian, TransUnion). It's free and doesn't hurt your score.
I only clicked, and didn't type or download anything
Close the page. You're very likely fine. Make sure your phone or computer is up to date, and keep an eye out for the things below over the next few days.
The next few days
Watch for these
- A sign-in prompt you didn't start. Tap Deny, then change that password.
- Password reset emails you didn't ask for.
- Login alerts, or charges you don't recognize.
- Friends saying you sent them something odd.
Report it
- Scam text: forward it to 7726 (it spells SPAM).
- Scam email: forward it to reportphishing@apwg.org.
- Lost money or gave info: ReportFraud.ftc.gov.
- Lost money online: the FBI at ic3.gov.
- Social Security number: IdentityTheft.gov.
Print it before you need it.
One page for the fridge or the front desk, so nobody's searching for this in a panic. I'll send my 10 weekend fixes with it, the ones that keep most of this from happening in the first place.
Who put this together
I'm Freeman Burns. My day job is incident response, which is a fancy way of saying I'm one of the people who gets called after something has already gone wrong. Nobody should get in trouble for saying "I think I clicked something." Saying so fast is the win.
Not sure what happened, or it happened at your business? Write me at info@ourcyberguy.com and I'll give you a straight answer.