Frequently Asked Question - What to do if you clicked on a Phishing link on any device

What Is a Phishing Attack?

This notorious scam has dominated the email threat landscape for decades. A phishing attack tricks users into sharing sensitive credentials or downloading malware. This is done when cybercriminals pose as a reputable party and then send fraudulent emails with this goal in mind. Phishers typically employ social engineering techniques to craft well-researched, convincing phishing campaigns. Phishing emails often contain malicious URLs that direct users to fraudulent websites where credentials are collected; however, attackers are increasingly employing stealthy fileless techniques in an effort to evade detection.

Costly Clicks - Beware of Phishing Links

How Do I Know if I’ve Clicked on a Phishing Link?

Before anything, it is essential you confirm you interacted with a phishing link, which can be confirmed by inconsistencies in the sender’s email address, links, and domains. Hovering your cursor over the link before clicking provides a preview of the URL, a domain that doesn’t exist is likely to be a phishing link. After confirming the phishing link, you must stop interacting with the page and delete any downloaded files. Search for the intended target site using a search engine. Compare the legitimate web address and content to the phishing site. Watch for suspicious account activity, calls, or texts. If attackers have previously collected your data successfully, victims may receive additional calls or messages asking for further action, as there is a higher likelihood the victim will engage after falling for a previous attempt.

What if I Clicked on a Phishing Link on My Smartphone?

Smartphones can be hacked via phishing links in text messages, emails, or software. By interacting with a phishing link, you risk accidentally downloading malware or being redirected to a malicious website controlled by hackers who intend to collect user information. A hacker only needs a device connected to the internet to infect it with malware.

Smartphones may be exploited with multiple malware variants. Purpose-built apps can compromise your device by causing apps to malfunction, drain your battery or data, slow the device, or even install apps.

Phishing Protection for iPhones & Mobile Devices

While iPhones are generally considered secure, they are still susceptible to phishing and hacking, among other types of security threats. Despite Apple's efforts to enhance security features in iOS, you should still be aware of potential risks such as phishing, malware, and other cyberattacks.

Contrary to popular belief, iPhones are not virus-proof. Malware, spyware, and adware can infiltrate your device through phishing emails, malicious apps, or social engineering. Keeping your iPhone and its apps updated with the latest security patches is critical to minimize the risk of malware attacks.

iPhones are vulnerable to hacking despite being more secure than Android devices. Hackers can exploit security loopholes in the iOS operating system or third-party apps to gain unauthorized access to your device, steal personal data, or install malware.

There are many security concerns regarding iPhones and the integrity and privacy of sensitive data. However, there are ways in which these risks can be minimized:

• Do not jailbreak your iPhone. Resist the temptation to “jailbreak” or bypass Apple's security restrictions. There might be a lot of cool features out there, but the dangers are not worth it. Plus, jailbreaking voids your device’s warranty!
• Do not install third-party apps. There are thousands of apps available on the official App Store. If you choose an iPhone, stick to these safe apps to prevent potential compromise.
• Be on the lookout for phishing scams. Don’t trick yourself into thinking that you won’t fall for scams; we all do. So beware of scam emails that request personal information and might steal account credentials.
• Do not open links from people you don’t know and recognize. This is simple advice, but it will help you avoid many headaches and potential dangers.
• Use multi-factor authentication. If hackers take over your phone, prevent them from attacking your other accounts successfully. Add extra steps to protect your credentials via two-factor authentication or multi-factor authentication (MFA).
• Use a VPN. A VPN will bolster your privacy and data protection, mainly if you use a public Wi-Fi network.
• Always keep your phone up to date. Make sure you are using the latest iOS update. Apple regularly adds new versions with new functionalities and, more importantly, safety patches to secure your devices.

Next Steps to Take if You’ve Clicked on a Phishing Link

In the event that you do fall for a phishing scam, it is essential to be aware of the actions you can take to help safeguard compromised information and recover from a phishing email attack. Even if you clicked on a phishing link but didn't enter any information, you are still at risk, as the link may have been used to deploy malware or spyware on your device. 

Our security engineers recommend these next steps that you should take if you either know or suspect that you’ve experienced an attack:

Disconnect your device from the Internet.

Disconnecting from the internet will help reduce the risk of malware spreading to other devices on the network. This will also prevent a malicious actor from accessing your device or sending out confidential information from it. 

• Enable airplane mode on iPhone and Android. Airplane mode can temporarily block hackers while your device is not connected to Wi-Fi. To enable airplane mode for iPhones, swipe down and tap “Airplane Mode” in Command Center to turn on and off.

For Android, swipe down from your home screen and tap “Airplane Mode” to turn on and off.

• Disconnect from the Internet. To disconnect your laptop from the Wi-Fi: right-click the network icon > Click “Network & Internet Settings” > Click “Wi-Fi networks” > Click the network to remove or delete under the “Manage Networks” list, then click “Forget.”
• Disable an Ethernet Connection in Windows 10. To disable an ethernet connection from your device, open the Wi-Fi networks panel > select the network you want to disconnect from > and click “Disconnect.”

Contact your bank.

Set up a fraud alert with either Equifax, Experian, or TransUnion that you can place on your credit report to make it more difficult for the attacker to open a new account in your name.

Back up your files.

Backing up your data is the best way to minimize the damage in case of a phishing email attack or in case they get erased in the recovery process.

Change your username and password.

If you were directed to a fraudulent website where you attempted to log in, immediately change your username and password. Use a password manager to make changing passwords across all devices easier. It will also help you to identify weak passwords and assist you in changing them to more secure ones.

Scan your system for malware.

After disconnecting your device from the internet, use an antivirus program to perform a scan of the device. Once completed, remove or quarantine any of the suspicious files detected to ensure further malware protection and phishing prevention. 

Report the incident to the Federal Trade Commission (FTC).

The FTC will provide you with a step-by-step recovery plan. Forward the phishing email you received to This email address is being protected from spambots. You need JavaScript enabled to view it. along with the organization being impersonated in the email to help raise awareness of the scam.

Enroll in cyber and email security awareness training.

Being educated is the best way to prevent a successful phishing email attack. You will learn about email threats such as phishing, ransomware, social engineering attacks, and more with proper employee education and training programs.

Tips & Best Practices to Avoid Clicking on a Phishing Link in the First Place

In order to prevent an attack, it is best to be aware of cyber and email security best practices and tips for recognizing a phishing email. Some tips for avoiding a phishing email attack and protecting sensitive information include:

• Check for spelling and grammatical errors, suspicious subject lines, and signatures. This is a crucial indication that the email is a phishing scam.
• Be wary of the display name. An email may say it’s from a known or trusted sender, but that might not happen. Even if the email address is legitimate, the message could come from a compromised one.
• Evaluate the salutation: Is the greeting vague or general? Does the tone sound suspicious coming from the person the email is allegedly from?
• If something feels off, confirm the email's legitimacy with the sender before interacting with it, or contact the source with a new email instead of hitting reply.
• Use a malware URL scanner to scan attachments for viruses, suspicious links, malware, or other dangerous code.
• Verify shared links to ensure they do not lead to fraudulent websites or malicious code.
• Phishing email attacks often urge users to act quickly; beware of this and think things through.
• Most importantly, think before you click. If there is something suspicious about the email, evaluate for warning signs.

Final Thoughts on Preventing Phishing Attacks 

Most importantly, if you’ve accidentally clicked on a phishing link, it is critical to learn from the incident and proceed cautiously. Always take time to stop and think before interacting with an email in any way. Phishing attacks often convey a sense of urgency to dissuade recipients from engaging in this best practice. That being said, the single most effective method of phishing prevention is investing in a comprehensive, fully managed email security software solution.