# You clicked something you wish you hadn’t. Start with what happened next.

If something already happened · 01 · 6 min read

The click itself tells you very little. What matters is what the page received, installed, or
persuaded you to approve.

This page helps you:

- Work out what the page received or changed
- Get a checklist in the right order for what happened
- Know what to watch in the days afterward

This is general guidance drawn from official sources. The provider involved, or the official body
where you live, decides what happens in your case. If you are in immediate danger, contact your
local emergency services.

## Start with what followed

The next step depends on what the page received or changed.

Reconstruct the minute after the page opened. Did you type anything, install anything, or approve a
prompt? The checklist below turns those actions into a short response plan. If you only viewed the
page, close it and check for a download or permission prompt before moving on.

## A quick way to gauge it

**What did you give the page, and what did you let it change?**

After the page opened, did you type anything into it (a password, sign-in code, card number, or
identity detail)? And did anything download, install, or ask you to approve or "allow" it?

If the answer to both is no, close the page and do not return through the same link. If either is
yes, that is the part to act on. The checklist below sorts the steps by what happened.

**The two questions, side by side**

- Did you type anything into it? No · Did anything download, install, or ask to be allowed? No ·
  Close the page: Do not return through the same link.
- Did you type anything into it? No · Did anything download, install, or ask to be allowed? Yes ·
  Act on what the page changed: The download, install, or approval is the part to act on.
- Did you type anything into it? Yes · Did anything download, install, or ask to be allowed? No ·
  Act on what you typed: The password, code, card, or detail you entered is the part to act on.
- Did you type anything into it? Yes · Did anything download, install, or ask to be allowed? Yes ·
  Act on both: Both parts need a response. The checklist keeps them in order.

Whichever box you land in, the checklist below turns it into steps in order.

## Sort out what happened next

Choose every action you remember. The checklist keeps the response in order. More than one can
apply. "I only landed on a page" stands alone and clears if you choose another action. If you are
unsure whether a file ran or a permission was granted, include that option. You can print the result
and work through it offline.

### What happened after the click?

**I only landed on a page. I didn't type or download anything.**

1. Close the page and do not return through the same link.
2. Check the browser's download list and recent site permissions. If you find a download or a
   permission you approved, choose that option instead.
3. Install available browser and operating-system updates through the device's settings or official
   update control.

**Another person connected through a remote-access app.**

1. End the remote session now. Disconnect the affected device from the internet and stop using it
   for email, banking, or password changes.
2. From a different trusted device, secure every account that was open or controlled. Start with
   email and accounts that can move money.
3. If a payment account was visible or controlled, call the provider through an official number and
   explain what the other person could see or do.
4. Use the remote-access steps below to check the affected device and remove access you did not mean
   to grant.

**I downloaded or installed something, or approved a prompt.**

1. If a file ran, an app installed, or you approved device control, disconnect the affected device
   from the internet. Stop using it for email, banking, or password changes.
2. Use the device-specific steps below before using that device to secure accounts.
3. If it's a work device, contact your IT team before trying to clean it up yourself.

**I typed a password.**

1. Open the account through its official app or site. If anything ran or installed, or another
   person connected, use a different trusted device before changing the password or sign-in
   settings.
2. Change that password anywhere else you used it, starting with email and accounts that can move
   money.
3. Check recovery methods, connected apps, and active sessions. Sign out other sessions where the
   service offers that control.
4. Use the account-takeover walk-through below for the rest of the recovery steps.

**I shared a sign-in or verification code.**

1. Open the account through its official app or site. If anything ran or installed, or another
   person connected, use a different trusted device.
2. Change that account's password. Someone who asks for a sign-in code often already has the
   password, so assume they may.
3. Then sign out other sessions where the service offers that control, and review recent sign-ins
   and changes.
4. Check recovery methods and connected apps, then use the account-takeover walk-through below for
   the rest of the recovery steps.

**I entered card or payment information.**

1. Tell your bank or card issuer what you entered and ask which replacement or account steps apply.
2. Review recent and new statements for activity you do not recognize.

**I entered personal identity details, such as an ID number or address.**

1. Write down which details you entered and keep the message or page address with the date.
2. Treat later contact that quotes those details as unverified. Knowing them does not prove who is
   contacting you.
3. If you entered a government ID number or document image, ask the issuing authority which
   reporting or replacement steps apply where you live. In the United States, IdentityTheft.gov has
   steps for a Social Security number you entered.
4. Use the personal-information guide below to match the next step to the details you shared.

### After clicking a bad link

Work from the top. The first steps contain anything that may still be active.

Choose what happened above. The relevant steps will appear here, ready to print.

- Do not act on any follow-up message about this until you have checked it on your own.

Two steps close out any of these: keep the message or a screenshot, with the date, in case you need
a record; and report the link to your email or messaging provider so it reaches fewer people.
Illustrative guidance. Exact steps vary by service and country.

## If you downloaded or approved something

The recovery tools differ by device. Start with the one where it happened. Installing something, or
approving a prompt you did not start, can give software or another person access to the device. Pick
where it happened for the relevant checks.

**Where did it happen?**

### On a phone · iPhone or Android

On this device: You downloaded an app or tapped "allow"

1. If another person is connected now, end the session. Turn off wi-fi and cellular data, or power
   the phone off, while you check what changed.
2. Open the phone's settings. Remove the app or configuration profile you installed at their
   request, and revoke screen-sharing, accessibility, or device-control permission you did not mean
   to grant.
3. Install available system and app updates. Review the phone maker's account and device-security
   notices for a sign-in or setting you do not recognize.
4. From a different trusted device, secure any account that was open or typed into, starting with
   email and payment accounts.

Illustrative. Exact menu names vary by phone and version.

### On a computer · Windows or Mac

On this device: You downloaded or installed a file

1. If the file ran or another person connected, disconnect from wi-fi or unplug the network cable.
   Stop using the computer for email, banking, or password changes.
2. With any remote session ended, use the computer's built-in or existing security software to run a
   full device check. If it needs an update, follow its official update path, then disconnect again
   before continuing. Follow the software or device maker's cleanup guidance for anything it finds.
3. Review recently installed programs and browser extensions. Remove an item only when you can
   identify it as something you did not choose.
4. From a different trusted device, secure any account that was open or typed into, starting with
   email and payment accounts.

Illustrative. If it's a work computer, contact your IT team before trying to clean it up yourself.

### A remote-access app · AnyDesk, TeamViewer, a "support" app

On this device: Someone asked you to install it so they could "help"

1. End the session and disconnect the device from the internet. Close the app, then remove it once
   you have saved any details you need for a report.
2. End the call. Do not call the number back; find the company's real support channel in its app, on
   a statement, or on its official website.
3. From a different trusted device, secure every account that was open or typed into. Start with
   email and any account that can move money.
4. If a payment account was visible or controlled, call the provider through an official number and
   tell it what the other person could see or do.

Remote-access tools are ordinary software. The problem is who was on the other end, not the app
itself.

If someone had remote access, guidance from the
[FTC](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams) also covers
updating your security software, running a full check with it, and changing any password you shared.

Reviewed July 2026. This guide draws on official guidance, but it is not the only route. Some of the
places that can help:
[FTC phishing guidance](https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams) and
[UK NCSC account-recovery guidance](https://www.ncsc.gov.uk/guidance/recovering-a-hacked-account).

## What to watch afterward

Check the accounts and device involved for changes you did not make. The timing depends on what
information or access the page received. None of these signs proves that a device or account
changed. Use them as reasons to check through the device's or account's official security tools:

- Money: A charge, transfer, saved payee, or payment method you do not recognize.
- Accounts: Password-reset or sign-in emails you didn't ask for. Don't click them; check the account
  directly.
- Device: An app, browser extension, configuration profile, or device permission you did not choose,
  or a warning from the device's own security tools.
- Contact: A follow-up "from the company" about the same problem. Treat any unexpected contact as a
  fresh thing to verify.

## Treat a recovery offer as unverified

**The next caller may know exactly what happened. That still does not prove who they are.**

A follow-up call or message may offer to "clean up" or "refund" the problem in exchange for a fee or
login. Treat any unexpected offer as a new request to verify. Do not use the number or link it
provides. Check through the company's official app, website, or a number you already trust.

## If it helps, read next

- [How to read the message that sent you here](/your-identity-online/fake-messages)
- [If you typed a password you use elsewhere](/your-identity-online/account-taken-over)
- [If you entered personal identity details](/your-identity-online/identity-theft)

---

_Part of Identity Explained (by Persona).
https://explained.withpersona.com/your-identity-online/clicked-a-link_