Clicking a phishing link is not always catastrophic on its own. The severity depends on what happened after the click: whether a page loaded, whether you entered any information, whether you downloaded anything, and whether the device was already protected. This guide covers the practical steps to take in the minutes and hours after a click, based on what you actually did on the page.
Disconnect panic from practical steps
The first thing to do is stop. Close the tab or browser window. Do not click anything else on the page. Do not enter any information if you have not already done so. If you are on a work device connected to a company network, consider disconnecting from the network (turning off WiFi or unplugging the ethernet cable) while you assess what happened — this limits potential lateral spread if the page attempted to install malware.
If you only clicked the link and the page loaded briefly before you closed it, and you did not enter any information or download anything, your risk is relatively low. Many phishing links go to pages designed to capture credentials — if you gave none, there is nothing to capture. However, it is still worth checking your device for any downloads that may have happened automatically, and running a malware scan if you have antivirus software installed.
The situation is more serious if you entered your email address and password, clicked "confirm" on any prompt, downloaded a file, or allowed any browser extension or app to install. In those cases, the steps below apply immediately.
Change passwords and revoke sessions
If you entered credentials, change the password for that account immediately — from a different device if possible, and using a network the attacker cannot intercept (your mobile data rather than the same WiFi connection). After changing the password, look for your account's "active sessions" or "signed-in devices" list and revoke any sessions you do not recognise. Most major services (Google, Microsoft, Facebook) have this in their security settings.
If you use the same password anywhere else — or a similar password pattern — change those accounts too. Attackers often run credential stuffing attacks immediately after harvesting login details, testing the same username and password combination across dozens of popular services.
Enable multi-factor authentication on the affected account if it was not already enabled. Even if the attacker now has your password, MFA requires a second factor (usually a code from an authenticator app or a text message) to log in. This does not undo the breach, but it limits how far an attacker can go with a stolen password alone.
When to contact banks, suppliers, or clients
If you entered payment card details, bank account information, or authorised a payment on the phishing page, contact your bank immediately. Australian banks have fraud teams available 24 hours and can place a hold on transactions or freeze the compromised card. The faster you contact them, the more options you have. Do not wait to see if a transaction appears — call as soon as you realise what happened.
If the phishing email impersonated a supplier or business partner, notify them — they may have had their email account or domain compromised, and other businesses in their network may be targeted with the same attack. If you are in any doubt about whether customer data was exposed, seek legal advice about notification obligations under Australia's Notifiable Data Breaches scheme before public disclosure.
- Close the tab immediately and do not interact further with the page.
- Check for unexpected downloads on the device.
- Change the password for the affected service from a clean device.
- Revoke active sessions in the account's security settings.
- Enable MFA on the affected account if not already active.
- If payment details were entered, call your bank immediately.
- Run antivirus or malware scan on the device used to click the link.
- Report the phishing attempt to Scamwatch and to the impersonated organisation.
Fast action matters most if someone entered a password, MFA code, or payment details.
Check a suspicious email