If you just clicked
You clicked the link. Here is what to do in the next twenty minutes.
A fake invitation, a delivery notice, a password reset that looked right. If you tapped it, and especially if you typed a password, this page walks you through locking the account back down, in order, one step at a time.
No sign-up. Nothing to install. Your checklist stays on this device.
First, one question
Did you type a password, a code, or approve a sign-in prompt after you clicked?
If the page asked you to pick your email provider and sign in to "view" something, that is the trap. Real invitations, documents and shared files never need your email password.
Next
Which account did the page ask you to sign in to?
Everything below lives in one place: your Google Account security page. Open it on a device the phishing link never touched if you can.
Where: myaccount.google.com/security
0/7
steps done
- 1
Change your password
Pick something new, not a variation of the old one. Google signs out every other device when you do this, which is most of the work in one move.
Done when: You are signed in with the new password and nothing else is.
- 2
Run the Security Checkup
It is near the top of the security page and may say you have recommendations. It gathers unfamiliar devices, recovery changes and connected apps into one list so you do not have to hunt.
Done when: Every item in the checkup is green or reviewed.
- 3
Review connected apps and remove anything you do not recognize
Most skippedLook for "Your connections to third-party apps and services", then "See all connections". This is how an attacker keeps reading mail after you change the password: an app you never heard of, granted access during the phish. Remove it.
Done when: Only apps you actually use are listed.
- 4
Check for forwarding and filters in Gmail
Most skippedIn Gmail settings, open "Forwarding and POP/IMAP" and then "Filters and Blocked Addresses". A forwarding address you did not add, or a filter that deletes or archives mail, means someone set up a quiet copy of your inbox. Delete it.
Done when: No forwarding you did not create. No filters you do not recognize.
- 5
Confirm your recovery phone and email are yours
Back on the security page, find your recovery options. If either one has changed to something you do not recognize, the attacker is trying to lock you out next. Set them back.
Done when: Recovery phone and email are both yours.
- 6
Turn on 2-Step Verification
If it is not on, turn it on now. Google prompts or an authenticator app are stronger than text codes. If it was already on, review which devices and methods are enrolled.
Done when: 2-Step Verification is on with a method you control.
- 7
Look at what went out
Check Sent and Trash. Attackers usually delete what they send, but not always. If you see messages you did not write, the people who received them need a heads-up.
Done when: You know who got a message from your account, if anyone.
Rather not do this alone?
Have someone walk you through it, step by step.
Tell us which account and what you see on your screen, and get told exactly where to tap next. No account access, no passwords, nothing to install.
If you are already locked out
Skip the checklist. Go straight to recovery.
If your password no longer works, or the recovery email and phone have been changed to ones you do not recognize, the attacker is ahead of you. Stop working the checklist and go straight to the provider's account recovery. Google, Microsoft and Apple each have one, and each will ask you to prove you are you from a device you have used before. Start it from the phone you normally use, not a new one.
Who else needs to know
You are not the only one who got it.
The person it came from
Their account is probably compromised too. That is how the message reached you. Tell them by text or in person, not by replying to the email, and send them this page.
Everyone else on the list
If the message went to a group (a class, a team, a club), someone should warn the group that the invitation was fake and not to sign in. The person whose account sent it is usually the right one to do that, once their account is back.
Anyone who already clicked
If you know someone who signed in through the same page, send them here. The steps are the same for them.
Report it so it stops
Two minutes now keeps the next person off that page.
Reporting takes two minutes and is the thing that actually shuts the page down for the next person. Do these in order.
Mark the email as phishing
In Gmail, Outlook or Mail, use Report phishing rather than plain Delete. That trains the filter for everyone on that provider.
Report the page to Google Safe Browsing
Chrome, Safari and Firefox all use this list. Once the page is on it, browsers warn people before the page even loads.
Forward it to the Anti-Phishing Working Group
Forward the original email as an attachment to reportphishing@apwg.org. Their feed reaches most security vendors at once.
Report a suspicious text to SmishAlert
If the message came as a text rather than an email, forward it to SmishAlert and you will get an answer back about whether it is a scam, plus what to do next.
FAQ
Questions people ask right after they click
I clicked the link but did not type anything. Am I okay?
Almost always, yes. On a current iPhone or Android phone, opening a web page by itself does not install anything or hand over your password. The danger is the sign-in form on the other side. If you closed it without typing, report the message, warn the sender, and move on.
I changed my password. Is that enough?
It is the most important step, but on its own it is not enough. Attackers routinely add a forwarding rule or connect a third-party app during the first few minutes, and both survive a password change. The connected-apps step and the forwarding-and-filters step are the ones people skip, and they are the ones that matter.
Why did the message come from someone I know?
Because they fell for the same page a day or two earlier. Once an attacker has an email account, they send the same lure to everyone in its contacts, and the sender's real name is what gets people to click. It is not personal, and it is not their fault.
The link went to a page that said Docs or Evite or Microsoft. Was it real?
No. Real invitations, shared documents and shared files never require you to sign in with your email password to view them. A page that asks you to pick your email provider and log in to see something is collecting passwords, whatever logo it shows.
Should I report this to the police?
If money was taken or an account was used for fraud, yes, file a report with your local police and, in the US, with the FBI's Internet Crime Complaint Center at ic3.gov. If nothing was taken, the reports above (Safe Browsing and APWG) do more to stop the page than a police report will.
I use the same password on other sites. What now?
Change it on every one of them, starting with email, banking and anything with a saved card. Then let a password manager generate a different one for each site so this never has to happen again.
For next time
Most of these start as a text. SmishAlert catches scam texts on your iPhone before you tap, and gives you a place to check the ones you are not sure about.