I clicked a suspicious link. What now?

You tapped a link and now you are not sure it was a good idea. Take a breath. What you do next depends on what happened, and most of the time it can be fixed. This checklist walks you through the first ten minutes, step by step.

First, in the next minute

1. Close the page. Do not enter anything on it, and do not tap any buttons.
2. Do not reply to the message or call the number in it.
3. Work out what happened. Pick the situation below that matches.

If you only opened the page and typed nothing

This is usually fine. Close the page and clear your browser’s recent history. Keep an eye out for strange behaviour over the next few days, such as unexpected pop-ups or apps you did not install. Then delete the message, and warn whoever sent it to you if it came from a friend.

If you entered a password

• Change that password right now, on the real website or app, and on any other account where you use the same password.
• Turn on two-step verification where you can.
• Do the change from a different device if you think your phone or laptop is affected.
• Check the account’s recent activity and sign out of all other devices if the service lets you.

If you entered card details, a UPI PIN or an OTP

• Call your bank immediately and ask them to block the card or the UPI access.
• Check your recent transactions for any you do not recognise.
• Then call 1930 and report the fraud.
• Keep screenshots of the message and the page, and note the time you entered the details.

If you installed an app or opened a file

• Turn off mobile data and Wi-Fi so it cannot send anything.
• Uninstall the app, or delete the file. If you cannot, ask for help with a factory reset.
• From a different device, change your email, banking and social media passwords.
• Call your bank, as the app may have been reading your SMS and OTPs. This is common in the fake KYC scam.

If you shared ID documents, Aadhaar or other personal details

Tell your bank, and watch for new accounts or loans in your name. Report it so there is a record, and keep copies of what you sent and when.

If someone called you and you stayed on the line

Hang up. If you shared anything or moved money, call your bank straight away. If the caller said you were under “arrest”, read the digital arrest call, explained: it is a scam, and you did nothing wrong by being frightened.

Afterwards

• Look at your bank statements for the next few weeks.
• Tell the people who might be targeted next: family, friends, the group chat.
• Report the number or message. You can use cybercrime.gov.in or the Sanchar Saathi portal.
• Next time, check the link before you open it.

Why this happens to everyone

These messages are built to land when you are busy or worried. If you want to understand why they work, read what phishing is and how it works. Nobody is immune to these scams, and it is not your fault. What matters is acting quickly.