What to Do If You Fall for a Phishing Scam

Phishing scams use fraudulent emails, text messages, or phone calls designed to trick you into revealing sensitive information such as passwords, banking credentials, or personal identification. If you suspect you have interacted with a phishing attempt, taking fast, structured action can significantly limit potential harm.

Immediate Action Steps

1. Disconnect from the network: If you downloaded a file or clicked an unexpected link, turn off your Wi-Fi or unplug your network cable immediately. This prevents malicious software from communicating with remote servers or spreading across your local network.
2. Change affected passwords: Log into the targeted account from a safe device or connection and change your password immediately. If you reuse that password across other services, update those accounts as well, starting with your primary email account.
3. Contact your bank or card issuer: If you submitted credit card details, bank account credentials, or social security numbers, call your financial institution using the official phone number on your card or statement. Ask them to freeze or cancel affected cards and monitor for unauthorized charges.
4. Enable multi-factor authentication (MFA): Activate MFA or two-factor authentication on all your important accounts. This provides a critical secondary layer of protection even if an attacker manages to obtain your password.
5. Run a full malware scan: Use trusted, updated security software to perform a full system scan of your computer or mobile device to identify and remove keyloggers, spyware, or viruses.

What NOT to Do

• Do not reply to the scammer: Responding confirms that your email address or phone number is active, making you a target for further attacks.
• Do not use contact info from the message: Never call phone numbers or click links provided inside the suspicious message. Always visit the company's official website directly.
• Do not ignore warning signs: If an account shows unfamiliar login activity, act immediately rather than waiting to see if further activity occurs.

Reporting and Ongoing Monitoring

Reporting the incident helps law enforcement and cybersecurity organizations disrupt scam operations. Forward phishing emails to official reporting addresses, such as the Anti-Phishing Working Group (reportphishing@apwg.org) or federal consumer protection agencies like the FTC (reportfraud.ftc.gov).

Monitor your bank statements and online accounts regularly over the following months. If personal identification details were exposed, consider placing a fraud alert or credit freeze with major credit bureaus to prevent unauthorized account creation in your name.

If you suspect severe identity theft or significant financial loss, report the incident immediately to your local police department and consult official consumer protection services.