I clicked — what now?

It happens to careful, clever people too. Scammers are professionals and work with pressure and surprise. What matters now is acting calmly, quickly and in the right order.

This plan is written for the UK. The steps are the same everywhere — only the numbers and the places to report differ. Not in the UK? See Outside the UK.

The steps

1Straight away

• Entered bank details, a card number or a one-time code, approved a payment in your banking app — or sent money? Call your bank straight away, using the number on your card or in your banking app, or, in the UK, call 159. Have your card or online banking blocked; sometimes a payment can still be recalled. Keep statements and all messages.
• Allowed remote access or installed something? Disconnect the device from the internet at once (Wi-Fi off, cable out) and switch it off. Change your important passwords — above all for online banking and email — from a different device you trust. Tell your bank.
• Entered a password? Change it straight away — and everywhere you use the same password. Change security questions too.

Get someone to help you. Call someone who stays calm and level-headed — ideally someone who also knows their way around computers and phones: the trusted person on your emergency card, or else someone from your family, your friends or your neighbours. Two people keep track more easily and are harder to rush. Only accept help from people you know and have called yourself, not from strangers who get in touch now. But don't wait for anyone before blocking your card or online banking.

2Today

• Report it. In England, Wales and Northern Ireland to Report Fraud: online at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101. Elsewhere, see Outside the UK. Keep the scam message — it's evidence.
• Shown your ID or sent a photo of it? With it, scammers can open accounts, take out contracts or apply for credit in your name (identity fraud). Report it, and if you know what you showed it for, contact that company on a number you look up yourself.
• Only clicked, but entered nothing? Have your antivirus check the whole computer — a click alone can do harm if the page hides malicious software.
  How to do it

  On Windows that's the built-in Windows Security: open it yourself (Start menu, type “Windows Security”), then Virus & threat protection → Scan options → Full scan. This can take a few hours. On a Mac, the built-in protection checks by itself; on a phone, install the latest update. Also check that your antivirus, browser and operating system update automatically.

• After remote access: have the device checked by an expert or someone you trust, and the remote-access program removed, before you use it for online banking again.

3Over the next few weeks

• Keep an eye on your accounts. Check statements more often, and see whether other accounts are affected.
• After showing your ID: check your credit report. In the UK, look at your reports with the three credit reference agencies — Experian, Equifax and TransUnion — for accounts or applications you don't recognise; you can do this for free.
  Extra protection with Cifas

  Cifas Protective Registration adds extra checks whenever someone applies for credit or an account in your name; it costs £30 for two years.

• Make signing in safer. Where offered, switch to passkeys — signing in with your fingerprint or face instead of a password. Otherwise turn on two-step verification where you can: besides your password, you then need a second proof, such as a code sent to your phone.

Spotted it in time?

In the UK, forward scam emails to report@phishing.gov.uk and scam texts to 7726 — free of charge on most networks. Then you can delete them; you only need to keep a message if you clicked or entered something.

Outside the UK

The steps above apply everywhere. Only the numbers and the places to report differ:

• Ireland: emergency 112 or 999. If money has gone, call your bank first, then report the fraud at your local Garda station.
• United States: emergency 911. Report fraud and scams at ReportFraud.ftc.gov, and cyber crime to the FBI at ic3.gov. Forward scam texts to 7726 (SPAM).
• Canada: emergency 911. Contact your local police, and report it to the Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca or on 1-888-495-8501 (weekdays).
• Australia: emergency 000. Report scams at Scamwatch, and cybercrime such as lost money or stolen details at cyber.gov.au. IDCARE helps you recover.
• New Zealand: emergency 111, police non-emergency 105. Netsafe helps with online scams: 0508 638 723.
• Germany: police emergency 110, or 112. The blocking hotline 116 116 (from abroad +49 116 116 or +49 30 4050 4050) blocks cards and online banking for all issuers that have joined it; it never calls you itself. Reports also online via the online police stations of the federal states.
• Anywhere else: call your bank on the number on your card, and contact your local police. 112 works across the EU.

We checked all numbers and services on 9 October 2026. They can change — if in doubt, go by what your bank or the police tell you.

Print this plan