You typed your password on a fake page: your first hour

Change the password on the real site from a device you trust, change it anywhere you reused it, turn on stronger sign in, and run a security scan if you opened a file. Then report the message. If you gave out financial or identity numbers, follow the FTC's steps for what was exposed.

First ten minutes

1. Do not reply or click again.
2. Go to the real site by typing the address or using the saved app. Change the password.
3. Change it elsewhere if you reused it. This is why CISA stresses unique passwords for every account.
4. Sign out other sessions if the service allows it.
5. Turn on multi-factor sign in, ideally a passkey or security key.

If you cannot sign in, use the service's account recovery steps, then secure the account.

If you clicked a link or opened a file

The FTC says that if a link or attachment may have installed harmful software, update your computer's security software, run a scan and remove anything it flags. Update the operating system too. If it was a work device, tell your IT team at once and do not try to hide it.

If the scammer may have financial or identity details

The FTC says that if they may have your Social Security, credit card or bank account number, go to IdentityTheft.gov for steps based on what was exposed. Consider a credit freeze. Call your card issuer or bank on the number on your card.

If you paid, use the steps by payment method.

Report it

The FTC lists these channels:

• Phishing email: forward to reportphishing@apwg.org, the Anti-Phishing Working Group
• Phishing text: forward to 7726 (SPAM)
• Any phishing attempt: ReportFraud.ftc.gov

CISA also says to use the report option near the sender's address or the report spam button in your email tool, and then delete the message.

If it was a work account

Tell your security or IT team immediately. Fast reporting matters more than who clicked. Provide the message, time, what you entered and whether you approved any prompts. Engineers can use our response checklist for engineers.

Look for what the attacker may have done

• New forwarding rules or filters in your mailbox
• Sign ins from unfamiliar places in your account activity
• Password reset emails you did not request
• New devices linked to your messaging or cloud accounts

This list is general good practice, not drawn from the FTC or CISA pages, so check each service's own security page.

Prevention for next time

CISA's signs: urgent or threatening language, requests for personal or financial information, untrusted shortened URLs and misspelled domains. CISA adds that poor grammar is no longer reliable, since AI can write flawless messages. If a message might be real, contact the company or person through a verified channel you already know.

Quick check

Sources

• FTC, How To Recognize and Avoid Phishing Scams
• CISA, Recognize and Report Phishing
• CISA, Use Strong Passwords

Last reviewed: 19 October 2026.