Clicked a Fake Bank Link? Do These 7 Steps Now

If you clicked a fake bank link, immediately call your bank’s fraud hotline, change your online banking password from a different device, and scan your device for malware. These first actions limit an attacker’s ability to use any credentials you may have entered. The steps below detail exactly what to do in the minutes and hours after a click, whether you entered information or not.

Why Fake Bank Links Work

Fake bank links usually arrive in phishing emails, text messages (smishing), or social media direct messages. The message often claims there is a problem with your account, a suspicious charge, or a limited-time offer. The link leads to a lookalike login page that captures your username, password, and sometimes your one-time code. Attackers then use that information to log in, transfer money, or sell your credentials.

Some fake links don’t ask for login at all—they install malware that records keystrokes or steals cookies. That’s why the first step is always to assume the worst, even if you didn’t type anything.

Immediate Steps (First 10 Minutes)

1. Disconnect from the internet – Turn off Wi-Fi or cellular data on the device you used. This can stop malware from transmitting your data.
2. Call your bank’s fraud line – Use the number on the back of your card, not any number in the suspicious message. Tell them you clicked a phishing link and may have exposed your login.
3. Change your password – If you can still log in, change your password from a different device (like your phone) using a direct visit to the bank’s website. Do not use the same device until it’s clean.
4. Enable two-factor authentication – If you haven’t already, turn on 2FA. If you already had it, check that the attacker didn’t change your phone number or email.

What to Do If You Entered Information

If you typed your username, password, or one-time code, the risk is much higher. In addition to the steps above:

• Request a new card number if you entered your card details.
• Check your recent transactions for any unauthorized charges.
• Place a fraud alert on your credit report (in the US, contact one of the three major credit bureaus).
• Change the password on any other account that uses the same password.

How to Remove Malware

If you clicked the link but didn’t enter anything, malware is still possible. Run a full antivirus scan on your device. For phones, use the built-in security app or a reputable mobile security app. In extreme cases, you may need to factory reset the device—back up your photos and contacts first, but be aware that malware can hide in backups.

Common Mistakes to Avoid

• Calling the number in the phishing message – it goes to the scammer.
• Reusing the same password across accounts – attackers will try it everywhere.
• Thinking “I didn’t enter anything, so I’m safe” – malware can still be installed.
• Waiting until the next business day to contact your bank – fraud systems work 24/7, but early action helps.

Frequently Asked Questions

I clicked the link but didn’t enter any info. Am I safe?

Not necessarily. Some links trigger downloads or redirects that install malware. Run a security scan and monitor your accounts for a few weeks.

Should I change my password if I already changed it once?

Yes, change it again after you’ve scanned your device. If malware is present, it could capture the new password too.

Can the bank reverse a fraudulent transfer?

Most banks will reverse unauthorized transactions if you report them promptly, but the exact process and time limit vary by bank and country. Call your bank immediately to start the dispute.

How do I know if the link was actually fake?

Check the URL carefully – look for misspellings, extra numbers, or domains like “bankname-security.com” instead of the real domain. When in doubt, type the bank’s address manually.

Should I tell my bank if I clicked but didn’t log in?

Yes. Even without entering credentials, your IP address and device info may have been captured. Banks can add a note to your account to watch for unusual activity.

What if I already gave the one-time code?

If you gave a code, the attacker may have already logged in. Call your bank immediately – they can terminate the session and block further access.

Preventing Future Phishing Attacks

Use a password manager that auto-fills only on legitimate sites. Enable 2FA on all financial accounts. Never click links in unsolicited messages – go directly to the bank’s app or website. Check your bank statements weekly. If a message creates urgency (“your account will be locked”), that’s a red flag.

Related

• Product Strategy Frameworks: Match Tool to Decision
• Paramount Plus August Lineup: Movies & Shows
• Benchmark AI Coding Agents on Large Python Codebases