Most scam links are built to get you to do something on the page that opens: type a password, enter card details, or download a file. Simply opening a page in an up-to-date browser rarely harms your device on its own. So the first question is not "did I click it?" but "what happened after I clicked?"
First, work out which situation you're in
| What happened | Risk | What to do |
|---|---|---|
| The page opened and you closed it straight away | Low | Close the tab, delete the message and keep an eye out for follow-up messages. |
| You typed a password or a login code | High | Change that password now on the real website, and anywhere you reuse it. |
| You entered card or bank details | High | Call your bank or card issuer using the number on your card. |
| You downloaded or installed something | High | Disconnect from the internet, remove it and run a security scan. |
| You gave personal details (address, birth date, SIN or SSN) | Medium to high | Watch your accounts and consider contacting the credit bureaus. |
In the first few minutes
- Close the page. Don't go back to it to "check" what it was. If you want to know where the link led, paste it into our Link Expander, which checks it from our server so the page doesn't open on your device.
- Change any password you typed. Go to the real website by typing its address yourself or using its official app, not by using the link again. If you use the same password elsewhere, change it there too.
- Turn on two-step verification for that account if it isn't on already. A stolen password is much less useful to a scammer if they also need a code from your phone.
- Call your bank if you entered card or banking details. Use the phone number on the back of your card or on the bank's official website. Ask them to block the card and watch for unusual transactions.
- Never share a one-time code. If someone calls or messages afterwards asking for a code "to fix the problem", it's the scammer. Real banks and companies don't ask for these codes.
If you downloaded or installed something
Disconnect the device from Wi-Fi or mobile data, then remove the app or file. On Windows 11, open Settings > Apps > Installed apps to uninstall it, then run a full scan in Windows Security > Virus & threat protection. On a Mac, drag the app from Applications to the Bin and check System Settings > General > Login Items for anything you don't recognise. On a phone, delete the app and check that no new "device management" or profile has been added. If the device belongs to your employer, tell your IT team right away.
Over the next few days
- Watch your statements and account activity for anything you don't recognise, even small amounts.
- Expect follow-up scams. People who click once are often targeted again, including by fake "fraud recovery" services that promise to get your money back for a fee.
- Check your credit if you shared identity details. In Canada the two credit bureaus are Equifax and TransUnion.
- Tell family or co-workers if the message came from a contact's account. Their account may have been taken over and used to message others.
Where to report it
Reporting helps others even when your own money is safe.
- Canada: report to the Canadian Anti-Fraud Centre online or at 1-888-495-8501. If you lost money, also report it to your local police and keep the file number.
- United States: report to the Federal Trade Commission at ReportFraud.ftc.gov.
- Scam texts: in Canada and the US you can forward them to 7726 (it spells SPAM) so your carrier can block the sender.
- Fake emails: use your email app's "Report phishing" or "Report spam" option, and forward brand impersonations to that company's official abuse address listed on its website.
Next time: check before you tap
Most scam links can be spotted in a few seconds. Our guide to spotting a fake link covers the warning signs, and how to see where a short link goes shows how to unmask shortened links before you open them.
Frequently asked questions
Can my phone get a virus just from opening a link?
It is rare on an up-to-date phone or computer. Most scam pages need you to type something, download a file or approve a permission. Keeping your system and browser updated closes most of the gaps that attacks rely on.
I only opened the page. Do I need to change my passwords?
If you didn't type anything into the page, you usually don't need to. Changing the password of the account the message pretended to be from is a reasonable precaution if it makes you feel safer.
Should I reply to the message to tell them I know it is a scam?
No. Replying confirms your number or address is active, which can lead to more scam messages. Report it and delete it instead.
What if the link came from someone I know?
Their account may have been taken over. Contact them another way, such as a phone call, to let them know, and don't open other links from that account until they confirm it is secure.