Clicked a Phishing Link? 12 Steps to Take Right Now (Phone, PC, Microsoft 365, UPI)

Quick answer: If you clicked a phishing link, act fast but calmly. Disconnect from the internet, do not type anything more on that page, change the password of any account you entered (from a different, safe device), sign out of all sessions, check that MFA is on and that no new MFA method or mail forwarding rule was added, and run a full antivirus scan.

If money or bank/UPI details are involved: call your bank immediately to block cards/UPI, and in India call the National Cyber Crime Helpline 1930 or report at cybercrime.gov.in as soon as possible. At work, tell your IT/security team right away; reporting early is never a mistake.

Last updated: 29 October 2026. Written by an IT security engineer who handles phishing incidents in a corporate environment.

It happens to everyone: a fake courier SMS, a "your account will be blocked" email, a "shared document" from a colleague, or a QR code. You clicked, and now your heart is racing. Don't panic. Clicking a link alone often does not cause damage; what matters is what you did on that page and how quickly you react.

This guide gives you a clear, step-by-step checklist for phones, PCs, Microsoft 365/Gmail accounts and UPI/banking, plus what IT teams should do when an employee reports a click.

Table of contents

1. First: what exactly did you do?
2. 12 steps to take right now
3. If money, UPI or bank details were involved
4. If it was your work (Microsoft 365) account
5. If you clicked on your phone
6. For IT teams: phishing incident checklist
7. Signs your account was compromised
8. How to avoid phishing next time
9. FAQ

First: what exactly did you do?

Your risk depends on what happened after the click:

What you did	Risk	Most important action
Only opened the link, closed it, typed nothing	Low	Close the tab, clear browsing data, run an antivirus scan, report the message.
Typed your email/password on the page	High	Change the password immediately from a safe device, sign out of all sessions, check MFA.
Approved an MFA prompt or typed an OTP/code	Very high	Report to IT immediately; attacker may already be signed in. Revoke sessions.
Downloaded/opened a file or installed an app	High	Disconnect from the internet, run a full scan, report to IT; device may need cleaning.
Entered card, UPI PIN or bank details	Critical	Call your bank now and call 1930.
Gave remote access (AnyDesk, TeamViewer, screen share)	Critical	Disconnect immediately, uninstall the app, call bank and 1930, change passwords.

12 steps to take right now

1. Stop. Do not enter any more information, do not approve any prompt, and close the page.
2. Disconnect from the internet (turn off Wi-Fi/mobile data or unplug the cable) if you downloaded a file or installed anything. This stops malware from talking to the attacker.
3. Use a different, safe device for the next steps if possible.
4. Change the password of the account you entered, and of any other account that uses the same password. Use a long, unique password.
5. Sign out of all sessions. Google: open Security > Your devices and sign out of every device you don't recognise. Microsoft personal account: on account.microsoft.com open Security and use the option to sign out everywhere. Work accounts: ask IT to revoke sessions.
6. Check MFA settings. Make sure MFA is on, and remove any phone number, authenticator app or security key you don't recognise.
7. Check email rules and forwarding. Attackers often add rules to forward or delete emails. Look in Outlook/Gmail settings for unknown forwarding addresses and rules.
8. Check recent activity. Look at sign-in history, sent items and recent security alerts for anything you didn't do.
9. Run a full antivirus scan. On Windows, use Windows Security > Virus & threat protection > Scan options > Full scan (or Microsoft Defender Offline scan).
10. Remove unknown apps and browser extensions installed around the time of the click.
11. Report it. At work, report to IT/security immediately. Use the Report phishing button in Outlook/Gmail so filters learn.
12. Warn your contacts if your account sent messages you did not write, so they don't click.

If money, UPI or bank details were involved

Speed matters most here. The earlier you report, the better the chance of stopping the money.

1. Call your bank's official helpline (from the bank's app or the back of your card) and block your debit/credit card, net banking and UPI.
2. Call 1930, the National Cyber Crime Helpline, or file a complaint at cybercrime.gov.in. See our step-by-step guide: How to file a cyber fraud complaint online in India.
3. Keep evidence: screenshots of the message, the link, transaction IDs, UTR numbers, and the phone numbers or UPI IDs used.
4. Report the fraud message (SMS, call or WhatsApp) on the government's Chakshu facility on the Sanchar Saathi portal. Note: Chakshu is for reporting suspected fraud communications; if you have already lost money, use 1930 or cybercrime.gov.in.
5. Never call "refund" or "recovery" numbers found online or sent by strangers: these are often second-stage scams.

Learn the common tricks in our guide to UPI scams in India.

If it was your work (Microsoft 365) account

Tell IT immediately. Do not feel embarrassed; good security teams thank people for reporting quickly. Share:

• The email or message (forward it as an attachment if your IT team asks, or use the Report button).
• The time you clicked and what you entered (password, MFA approval, code, file opened).
• Whether you see anything strange: MFA prompts you didn't start, emails in Sent Items you didn't send, new inbox rules.

Be extra careful with "enter this code" messages: attackers use device code phishing to get into Microsoft 365 accounts even when MFA is enabled.

If you clicked on your phone

• Close the browser tab and clear browsing history and data for that browser.
• If an app was installed (especially an APK from outside the Play Store), uninstall it, then check Settings > Apps > Special app access for accessibility, device admin, or "install unknown apps" permissions you didn't grant.
• On Android, run a Google Play Protect scan.
• Change passwords of important apps (email, bank, social media) from a safe device.
• Read our full guide: Is my phone hacked? Warning signs and what to do.

For IT teams: phishing incident checklist

When a user reports a click in Microsoft 365, a fast standard response limits damage:

1. Contain the account: reset the password, revoke sessions (Microsoft Entra admin center > Users > user > Revoke sessions), and require MFA re-registration if an attacker method was added.
2. Check sign-in logs for the user: unusual countries, IPs, apps or device code sign-ins around the click time.
3. Check mailbox persistence: inbox rules, forwarding (SMTP forwarding and rules), delegates and recently consented OAuth apps.
4. Find other recipients: search for the same email across the tenant (Threat Explorer or Advanced Hunting) and purge it. Our EmailEvents KQL guide has ready queries.
5. Check URL clicks to see who else clicked (Safe Links / UrlClickEvents).
6. Isolate the device in Defender for Endpoint if a file was opened, and run a full scan.
7. Block indicators: sender, domain and URL in the Tenant Allow/Block List.
8. Document the incident (timeline, impact, actions) for audit and lessons learned.

Signs your account was compromised

• MFA prompts or OTPs you didn't request.
• Password reset emails you didn't start.
• Sent emails or messages you didn't write.
• New inbox rules, forwarding addresses, or missing emails.
• Sign-ins from unknown locations or devices in your security activity page.
• Bank or UPI transactions you don't recognise.

How to avoid phishing next time

• Pause on urgency: "account blocked", "KYC expiring", "parcel held", "salary revision" are classic tricks.
• Check the sender and link: hover over links; look for misspelled domains and odd extensions.
• Never share OTPs, UPI PINs or MFA codes with anyone, including people claiming to be from your bank or IT team.
• Go directly: open the bank, courier or company website by typing it yourself instead of clicking links.
• Use a password manager: it won't autofill on a fake website, which is a great warning sign.
• Upgrade to phishing-resistant sign-in like passkeys wherever possible.

FAQ

Can you get hacked just by clicking a link?

It is possible but less common, usually only if your browser or device is out of date and the site exploits a vulnerability. Most damage happens when you enter details, approve a prompt or download a file. Keep your browser and OS updated and run a scan to be safe.

I clicked a phishing link but didn't enter anything. What should I do?

Close the page, clear your browser data, run a full antivirus scan, report the message, and watch for unusual activity for a few days. Changing your password is a good precaution.

What is the cyber crime helpline number in India?

Call 1930, the National Cyber Crime Helpline, or report online at cybercrime.gov.in, especially if money was lost.

Should I tell my IT team if I clicked a phishing link at work?

Yes, immediately. Early reporting lets IT block the attacker, protect other employees and remove the email from everyone's mailbox. Hiding it makes the damage much worse.

Does changing my password remove the attacker?

Not always. Also sign out of all sessions, check MFA methods, remove unknown forwarding rules and connected apps, and at work ask IT to revoke sessions.

Final words

Clicking a phishing link is a mistake, not a disaster, if you react quickly. Save this checklist, share it with your family and colleagues, and remember the two numbers that matter most in India: your bank's helpline and 1930.

Sources

• Sanchar Saathi: Chakshu, report suspected fraud communication (and 1930 / cybercrime.gov.in for financial fraud)
• National Cyber Crime Reporting Portal (cybercrime.gov.in)

This article is general security guidance. For financial fraud, contact your bank and the official cyber crime helpline immediately.