Clicked a Bad Link on Your Phone? What to Do in the Next 10 Minutes

You tapped a link in a text about a missed package, and the page that opened looked wrong. Now you want to know how to know if your phone is hacked after clicking a link, and what to do about it. The good news: a tap on its own is usually not the whole story. What matters most is what happened next. Did you type a password, enter card details, download a file or install something? The checklist below sorts that out in about 10 minutes, and it works for both iPhone and Android.

Red flags that the link did more than open a page

Some signs point to a real problem rather than a near miss. Take them seriously if any of these are true:

• You typed a password, a verification code or a card number into the page that opened.
• A file downloaded, or the page asked you to install an app, a "security update" or a configuration profile.
• You got a sign in alert or a code you did not request soon after tapping.
• Your email, Apple Account or Google Account shows a login from a device or place you do not recognize.
• New apps appear that you do not remember installing, or an app asks for permissions it never needed before.
• Friends say they got strange messages from you.
• Your bank or card issuer flags charges you did not make.

The FTC's phishing guide lists the usual bait behind these links: a claim of suspicious activity on your account, a problem with your payment information, an invoice you do not recognize, or a request to click and pay. If the message that got you fits one of those, assume it was a scam even if nothing obvious happened.

For the slower, longer term warning signs like battery drain and data spikes, our guide on how to know if your phone is hacked covers a full inspection.

The 10 minute checklist after a suspicious link

Work through these in order. Skip any step that clearly does not apply.

1. Close the tab and do nothing else on that page. Do not tap "unsubscribe" or reply. CISA's advice in its phishing guidance is to delete the message without clicking anything in it, including any unsubscribe link. Report it first if you can (see the last section).
2. Decide what you gave away. If you only looked at the page, your risk is much lower. If you entered a password or code, go straight to step 3. If you entered card or bank details, go to step 5 as well.
3. Change the password you typed, from a fresh window. Open the real site or app yourself, never through the link. If you reuse that password anywhere else, change it there too. A password manager makes this much faster.
4. Secure your phone's main account. On iPhone, Apple says that if you think your Apple Account is compromised or you entered your password on a scam site, you should change your Apple Account password right away and make sure two factor authentication is on, per Apple's scam guidance. On Android, Google's steps to secure a compromised Google Account start in your Google Account under Security & sign-in, where the "Recent security events" panel lets you pick Review security events. If something there was not you, choose "No, it wasn't me." Then check Your devices and Manage devices, and remove any you do not recognize.
5. Call your bank or card issuer if you entered payment details. Use the number on the back of your card, not one from the message. Ask them to watch for fraud or replace the card.
6. Check for anything that installed. Look through your recent apps and remove anything unfamiliar. On Android, open the Google Play Store app, tap your profile icon, then Play Protect, then Settings, and make sure "Scan apps with Play Protect" is on. Google recommends keeping Play Protect switched on at all times.
7. Update your phone and run a scan. The FTC says that if a link downloaded harmful software, you should update your security software, then run a scan and remove anything it flags. Installing the latest iOS or Android update closes holes that scam pages try to use.
8. Turn on two factor authentication everywhere it matters. Email, banking and your phone account come first. Our walkthrough on protecting your online accounts in 10 minutes covers the main ones.

Can a phone get hacked just from clicking a link?

It is possible, but it is not the usual outcome. Most scam links are built to trick you into handing over a login, a payment or a permission. The page itself is the trap, not the tap.

Attacks that take over a phone with no further action from you do exist, but they tend to be expensive and aimed at specific people, such as journalists or officials. We covered one such case in our report on zero click spyware hidden in online ads. Apple offers Lockdown Mode for people in that position. Apple describes it as an optional, extreme protection meant for the very few people who might be personally targeted, and notes that most people are never targeted this way. If you think you might be one of them, you can turn it on in Settings, then Privacy & Security, then Lockdown Mode. The phone restarts with some features limited.

For everyone else, keeping the phone updated does most of the heavy lifting.

If something on the phone still feels wrong

On Android, safe mode helps you find out whether an app is behind odd behavior. Google explains that restarting in safe mode varies by phone, so check your maker's instructions. If the problem stops in safe mode, an app is the likely cause. Remove recently downloaded apps one at a time, restarting normally after each, until the problem goes away. Our step by step guide on removing a virus from Android goes deeper.

On iPhone, apps from outside the App Store are rare, so look harder at accounts than at apps. Review which devices are signed in to your Apple Account and remove any you do not recognize. Then check for any configuration profiles you did not add.

As a last resort, back up your photos and contacts, then reset the phone. Restore only what you need and reinstall apps from the official store rather than from a full backup.

What to do if your information was already taken

If you handed over a Social Security number, bank account or card number, the FTC points you to IdentityTheft.gov, where you can report identity theft and get a personal recovery plan. That plan includes steps like placing a credit freeze.

Report the scam too. It helps others and builds a record if you need one later:

• Forward a scam text to 7726 (SPAM), or use the "report junk" option in your messaging app.
• Forward a phishing email to reportphishing@apwg.org.
• Report the scam to the FTC at ReportFraud.ftc.gov.
• If the message pretended to be Apple, email it or a screenshot to reportphishing@apple.com.

One last habit to keep: when a message pushes you to act fast, stop and contact the company through an app or number you already trust. That single pause stops most of these scams before they start. More tips live in our tech section.