You receive a message:
“Your bank account will be suspended. Verify immediately.”
You click the link.
A page opens that looks exactly like your bank’s website.
Then you realize:
THE WEBSITE ADDRESS IS WRONG.
Now the questions begin:
“Have I been hacked?”
“Should I change my passwords?”
“Can they steal money?”
“Should I switch off my phone?”
The answer depends on what happened after you clicked.
There is an important difference between:
CLICKED LINK ONLY
ENTERED PASSWORD
ENTERED OTP / MFA CODE
ENTERED CARD / BANK DETAILS
DOWNLOADED A FILE
INSTALLED AN APP
ALLOWED REMOTE ACCESS
The correct response therefore starts with:
STOP → IDENTIFY WHAT YOU DID → SECURE WHAT WAS EXPOSED → CHECK DEVICE → PRESERVE EVIDENCE → REPORT → MONITOR
First — What Happened After You Clicked?
Do not assume that every phishing-link click has the same impact.
Start by identifying exactly what happened.
You Only Opened the Page
You clicked the link but:
- Entered nothing
- Downloaded nothing
- Installed nothing
- Approved nothing
Your risk may be lower.
Close the page and continue checking the device and accounts for anything unusual.
Do not reopen the link simply to investigate it yourself.
You Entered a Username and Password
Treat those credentials as:
COMPROMISED
The attacker may immediately attempt to log in.
If the password was reused elsewhere, those accounts may also be at risk.
You Entered an OTP or MFA Code
This is more urgent.
The attacker may already have:
USERNAME + PASSWORD
and be waiting for:
YOUR MFA CODE
to complete the login.
Act immediately.
You Approved an Unexpected MFA Request
If you received:
APPROVE SIGN-IN?
and selected:
YES
for a login you did not initiate, assume the attacker may have authenticated.
You Entered Card or Banking Information
Treat the information as exposed.
Contact your financial institution immediately.
Do not wait for an unauthorized transaction to appear.
You Downloaded a File
The risk depends on what happened next.
A downloaded file that was never opened is different from one that was:
OPENED / EXECUTED
Do not open it again.
You Installed an Application
This requires more attention.
A malicious application may attempt to:
- Steal credentials
- Read messages
- Capture information
- Establish persistence
- Provide remote access
You Allowed Remote Access
If someone convinced you to install or use a remote-access tool and gave them control of the device, treat the incident as potentially serious.
The attacker may have been able to see or access much more than the phishing page.
What Should You Do Immediately?
Once you realize the link may be malicious, stop interacting with it.
Step 1 — Close the Suspicious Page
Do not:
- Enter more information
- Download additional files
- Call numbers shown on the page
- Follow its recovery instructions
The phishing page may attempt to keep you engaged.
Step 2 — Do Not Contact “Support” From the Page
A fake bank page may display:
“CALL CUSTOMER SUPPORT NOW.”
That number may belong to the attacker.
If you need help, independently open the organization’s:
OFFICIAL APP
or manually access its:
OFFICIAL WEBSITE
CISA recommends independently contacting the organization rather than using links, attachments or phone numbers contained in suspicious messages.
Step 3 — Preserve the Phishing Message
Before deleting it, preserve useful evidence where practical:
- Screenshot
- Sender email
- Phone number
- Website address
- SMS
- WhatsApp message
- Date and time
Do not keep visiting the malicious site to collect additional evidence.
Step 4 — If You Entered a Password, Change It
Use a trusted device where possible.
Go directly to the legitimate service.
Do not use the phishing link again.
Change:
COMPROMISED PASSWORD
to:
NEW + STRONG + UNIQUE PASSWORD
Step 5 — Change Reused Passwords
Suppose the stolen password was:
ExamplePassword123
and you used it for:
- Shopping
- Cloud storage
Assume those accounts may also be targeted.
CERT-In warns that reused compromised credentials can allow attackers to attempt access to other accounts.
Step 6 — Sign Out Other Sessions
Look for:
SIGN OUT ALL DEVICES
or:
LOG OUT OTHER SESSIONS
where available.
This helps remove unauthorized sessions.
Step 7 — Check MFA
Verify:
- Authenticator methods
- Phone numbers
- Security keys
- Trusted devices
- Backup codes
Remove anything you did not configure.
Step 8 — Secure Your Primary Email
If your email password was exposed, prioritize it.
Your email can often reset passwords for many other accounts.
Use:
SECURE EMAIL → SECURE OTHER ACCOUNTS
Step 9 — Check Account Activity
Look for:
- Unknown logins
- Password changes
- New devices
- Sent messages
- Recovery changes
- Connected applications
CERT-In’s 2026 Microsoft 365 advisory warns that modern phishing campaigns can target credentials and session tokens and may establish persistent unauthorized access even in environments using MFA.
What If You Downloaded or Installed Something?
Clicking a phishing link may sometimes lead to malware.
If a File Downloaded Automatically
Do not open it.
If you can safely identify the downloaded file:
DO NOT EXECUTE IT
Use your device’s security software to scan the system.
If You Opened the File
Treat the risk more seriously.
The file may have attempted to:
- Install malware
- Steal browser information
- Capture credentials
- Run malicious scripts
Run an updated security scan.
If You Installed an Unknown Application
If you knowingly installed something from the phishing site, especially a:
- APK
- Remote-support tool
- Browser extension
- Unknown executable
assume the device may require further investigation.
If You Gave Remote Access
If an attacker currently has remote control:
DISCONNECT THE DEVICE FROM THE NETWORK
where practical.
Then use another trusted device to:
- Secure primary email
- Secure financial accounts
- Change exposed passwords
Do not continue logging into sensitive accounts from a device you believe may still be under attacker control.
Check Browser Extensions
Review installed extensions.
Remove suspicious extensions you did not intentionally install.
Update the Device
Install current:
- Operating-system updates
- Browser updates
- Application updates
- Security updates
Run Security Scans
Use reputable, updated security software.
If serious compromise is suspected and you cannot establish whether the device is clean, obtain trusted technical assistance.
Do Not Install Random “Virus Removal” Tools
Searching:
“MY PHONE HACKED FIX NOW”
may lead to additional malicious software.
Use trusted security products and official support channels.
What If You Entered Banking, Card or UPI Details?
This requires immediate action.
Contact Your Bank
Use:
- Official banking application
- Number printed on the card
- Official bank website
- Verified bank contact
Do not use the phone number shown in the phishing message.
Explain what information was exposed.
If Card Information Was Entered
Ask the bank whether the card should be:
BLOCKED / REPLACED
depending on what was exposed.
If Internet Banking Credentials Were Entered
Change them immediately through the official banking channel and notify the bank.
If an OTP Was Shared
Tell the bank.
An OTP may indicate an attempted transaction or authentication event.
Check Recent Transactions
Look for:
- UPI payments
- Card transactions
- Bank transfers
- New beneficiaries
Report anything you do not recognize.
If Money Has Already Left
Act immediately:
CONTACT BANK
↓
CALL 1930
↓
REPORT THROUGH CYBERCRIME PORTAL
↓
PRESERVE TRANSACTION DETAILS
The National Cyber Crime Reporting Portal supports reporting of financial fraud and other cybercrime complaints, and its current portal directs victims of cyber financial fraud to 1930 for immediate reporting.
Useful information may include:
- Transaction ID
- Amount
- Date and time
- Bank/wallet
- Beneficiary information
- Screenshots
Report the Phishing Attempt and Continue Monitoring
Even if you did not lose money, the phishing attempt can still be reported.
Report the Suspicious Identifier
India’s National Cyber Crime Reporting Portal currently provides a Report Suspect facility for suspicious:
- Website URLs
- WhatsApp numbers
- Telegram handles
- Phone numbers
- Email IDs
- SMS headers/numbers
- Social-media URLs
This can help authorities build information about cybercrime infrastructure.
Report the Message to the Platform
Use the built-in:
REPORT PHISHING
REPORT SPAM
or:
REPORT SCAM
option where available.
Tell Your Workplace
If you clicked the phishing link using a:
WORK EMAIL
WORK LAPTOP
or entered:
CORPORATE CREDENTIALS
contact your IT/security team immediately.
Do not hide the incident because you are embarrassed.
Security teams may need to:
- Revoke sessions
- Reset credentials
- Check endpoint activity
- Search for similar emails
- Protect other employees
Monitor Your Accounts
Over the following days, watch for:
- New login notifications
- Unexpected password resets
- Unknown transactions
- New MFA prompts
- Messages you did not send
- Recovery-information changes
Expect Follow-Up Scams
The attacker may know:
- Your name
- Phone number
- Bank
- Account information
You may receive another message pretending to be:
BANK SUPPORT
POLICE
CYBERCRIME OFFICER
RECOVERY AGENT
Do not assume the second person is legitimate simply because they know details about the first incident.
Learn How the Phishing Worked
After securing yourself, review:
WHAT MADE ME CLICK?
Was it:
- Urgency?
- Fear?
- Fake bank warning?
- Delivery notification?
- Job offer?
- Refund?
- Account suspension?
Understanding the trigger helps prevent another incident.
Summary
If you clicked a phishing link, the most important question is:
WHAT HAPPENED AFTER THE CLICK?
Use:
STOP → IDENTIFY EXPOSURE → SECURE → CHECK DEVICE → PRESERVE → REPORT → MONITOR
If you only opened the page:
CLOSE + CHECK + REPORT + MONITOR
If you entered a password:
CHANGE PASSWORD + REVOKE SESSIONS + CHECK MFA + SECURE REUSED ACCOUNTS
If you entered financial information:
CONTACT BANK IMMEDIATELY
If money was lost in India:
CALL 1930
and report through:
If you installed software:
CHECK THE DEVICE FOR COMPROMISE
If you exposed work credentials:
CONTACT YOUR IT / SECURITY TEAM
Useful Links and References
SanchitGurukul Static Resources
Official External References
National Cyber Crime Helpline — India
1930
Your feedback matters
Was this post helpful?
Discussion
0 approved comments
No approved comments yet. You can start the discussion below.
Leave a Comment
No login is required. Name and email are used for moderation/security. Your email is never displayed publicly. All comments require administrator approval.
Discover more from SanchitGurukul
Subscribe to get the latest posts sent to your email.
