Phishing is a method where criminals try to get you to open harmful links, emails, or attachments that request personal information or install malware on your device [2]. Clicking a link does not automatically mean your accounts are compromised, but it does mean you should check a few things promptly. Urgent or frightening language is a common feature of these messages, designed to make you act before you think. If you realize you clicked a link, try not to respond to the message, reply to the sender, or click further links in the same thread while you sort things out.
Keep the original message. The FBI recommends keeping screenshots of messages, because they can help investigators and may show the sender details, the link you clicked, and the date and time you received it [4].
Check whether you approved access or a device
Some phishing links lead to a real login or permission screen rather than a fake one. In OAuth consent phishing, the link sends you to a legitimate permission request. If you approve it, you grant a malicious application high-level access that can read and send emails and reach sensitive data, all without your password. The FBI warning on this attack notes that it can bypass both passwords and multifactor authentication [4].
Ask yourself whether you approved any permission or authorization request after clicking a link. If you did, the usual step of changing your password may not remove that access. According to the FBI, access from this type of attack can only be revoked by invalidating the token in the application security settings [4]. Only grant authorization to applications you trust.
Secure the account and watch for takeover signs
After an account takeover, a scammer may change your password and lock you out, send scam messages to your contacts, share malicious links, or try to steal money or information from people you know [8]. Warning your contacts that you may have been compromised, and asking them not to open unexpected links from your account, can limit the spread.
Turning on multifactor authentication and avoiding password reuse can help prevent account takeovers in the first place [8]. If you have not yet enabled multifactor authentication on your important accounts, doing so is a useful step, though it is not a cure for consent-based attacks, so the permission check remains vital.
Do not rely on messages from a platform to verify its own security alert. Social media platforms will not contact you about an account problem by text, phone call, or direct message [8]. To check, go to the platform directly and use its official help page instead of replying to the message you received.
Verify the sender through a separate channel
Phishing messages are built to look like they come from a trusted person or organization, and they may arrive by email, text, social media message, or phone call [2]. Good grammar no longer proves a message is real, because artificial intelligence can produce polished text [2].
Look closely at the link. A link may closely resemble a legitimate address or use a subdomain of a trusted domain, and shortened URLs hide their destination [2]. Traffic distribution systems can also redirect you from ads, links, or compromised websites to fake login pages or malware downloads, so a site that looked normal may still have sent you somewhere harmful [5].
If a message claims to be from a bank, company, or contact, confirm it through a separate, known channel, such as the phone number printed on a statement or the official app, rather than replying or calling a number in the message [4]. Messages from unfamiliar numbers or accounts deserve extra scrutiny [4].
Report the incident
The FBI asks victims of online crime to report to the Internet Crime Complaint Center (IC3) at ic3.gov, and to their local FBI Field Office [4]. Bring the screenshots and any other details you saved, since they help investigators trace the attack.
CISA guidance follows three steps: Recognize, Resist, and Report [2]. If you suspect phishing, resist clicking links or attachments, and report the message so it can be investigated. Reporting helps authorities spot patterns across many victims.
The FTC also publishes consumer guidance on phishing and how to recognize scams [1]. Its materials are a useful reference for learning the warning signs. Where federal sources are silent on specific recovery tasks, check official agency pages directly for current instructions.
