What Happens When You Click a Phishing Email?

Clicking a link or attachment in a phishing email can trigger a chain of events that may compromise your personal data, install malware, or give attackers access to your accounts. The exact outcome depends on what you clicked and what security measures you have in place, but the process typically unfolds in stages, from the initial request to a remote server to the eventual theft of credentials or data.

Formula

The calculator above estimates a simple risk score based on time since clicking a phishing link and the estimated probability of a data breach if no action is taken. The formula is:

Risk Score = min(100, (Time in hours / 24) × Probability %)

Where:

• Time since click (t) – hours elapsed since the click, default 1 hour
• Probability of breach (p) – your estimate (0-100%) of how likely a breach is if you do nothing

The score increases with time, reflecting that the longer you wait, the more damage can occur. It caps at 100.

Worked Example

Using the defaults: t = 1 hour, p = 50%.

Risk = (1 / 24) × 50 = 2.08, rounded to 2.

So after one hour with a 50% breach probability, the risk score is 2 out of 100—low but not zero.

What Actually Happens in the First Seconds

When you click a link in a phishing email, your browser sends a request to the attacker’s server. That server can do several things:

• Log your IP address and user agent – confirming your email address is active and your device type.
• Redirect you to a fake login page – designed to look like your bank, email provider, or social media.
• Trigger a download – of a malicious file (PDF, Word doc, ZIP) that exploits a vulnerability in your software.
• Run a drive-by download – silently installs malware without any visible action.

The moment you click, the attacker knows you are a viable target. Even if you close the tab immediately, your IP and device info are already captured.

Credential Theft: The Classic Phishing Outcome

Most phishing links lead to a fake login page. If you enter your username and password, the attacker captures them and often uses them within minutes. They may:

• Log into your account – change the password, lock you out, and use it for further attacks.
• Harvest other credentials – if you reuse passwords, they try them on other services.
• Send phishing emails from your account – to your contacts, spreading the attack.

Two-factor authentication (2FA) can stop this if the attacker doesn’t have your phone, but some phishing kits intercept 2FA codes in real time (known as “man-in-the-middle” attacks).

Malware Installation: What Happens on Your Device

If the link downloads a file, opening it can install various types of malware:

• Keyloggers – record every keystroke, capturing passwords and messages.
• Ransomware – encrypts your files and demands payment.
• Remote access trojans (RATs) – give the attacker control of your computer.
• Spyware – monitors your activity and steals personal information.

Modern malware often tries to disable antivirus software and hide its presence. Even if you don’t see anything happen, the infection can be silent for weeks.

Data Exfiltration: What They Steal

Once inside your system, attackers look for valuable data:

• Saved passwords in browsers
• Financial information (bank accounts, credit cards)
• Personal documents (IDs, tax returns)
• Work-related files (if on a corporate device)

They may also install backdoors to maintain access, even after you clean the system.

Immediate Steps to Take After Clicking

Act fast to limit damage:

1. Disconnect from the internet – unplug Ethernet or turn off Wi-Fi to stop data transmission.
2. Change your passwords – from a different, trusted device. Change the password for the account the email impersonated, and any account that uses the same password.
3. Enable two-factor authentication – on all important accounts.
4. Run a full antivirus scan – using up-to-date software.
5. Contact your bank – if you entered financial details, place a fraud alert.
6. Report the email – to your email provider or IT department.

If you clicked but didn’t enter any information, the risk is lower, but still run a scan and monitor your accounts.

Common Misconceptions

• “I’ll know if I’ve been hacked.” – Many attacks are silent. Attackers often wait days or weeks before using stolen data.
• “Phishing is only about passwords.” – It can also deliver malware, steal cookies, or turn your device into a botnet.
• “Macs and phones are safe.” – They are less targeted, but not immune. Phishing works on any device.

Frequently Asked Questions

Can I get hacked just by clicking a link?

Yes, but it depends on the link. Some links lead to fake login pages (you must enter credentials), while others exploit browser or plugin vulnerabilities to install malware without any further action. The risk is higher if your software is outdated.

What if I clicked but didn’t enter anything?

You are safer, but not completely. The attacker may have recorded your IP address and device info. Run a malware scan and change passwords if you suspect anything. Also, check your browser history for unusual redirects.

Should I click “unsubscribe” in a phishing email?

No. Clicking unsubscribe confirms your email is active and can lead to more phishing. Delete the email without clicking any links.

Can phishing emails install malware without me downloading anything?

Yes, through drive-by downloads that exploit vulnerabilities in your browser or plugins. Keeping software updated reduces this risk.

How long do I have to act after clicking?

Act immediately. The first hour is critical. Attackers often automate credential checking within minutes. The longer you wait, the more accounts they can compromise.

Does two-factor authentication protect me?

It helps, but not always. Some phishing kits intercept 2FA codes in real time. However, it still blocks many attacks, so enable it everywhere.

Related

• Delete Old Kernels in CentOS, RHEL & Fedora
• Blue Switches for Gaming: Pros, Cons & Verdict
• Logout in Bash Scripts: Workarounds That Work

in t | Time since click | hours | 1 | 0 | 72
in p | Probability of data breach if no action | % | 50 | 0 | 100
out risk | Risk score (0-100) | - | min(100, (t / 24) * p) | 0