Change compromised passwords immediately
If you entered credentials, change that password on the real site right now. Then check every account that uses the same password — credential stuffing (trying stolen passwords on other sites) is automated and begins within hours. Use unique passwords for every account going forward.
Enable multi-factor authentication (MFA)
On every account you just changed: enable MFA immediately. Even if an attacker has your new password, MFA (especially authenticator apps like Google Authenticator or Authy) blocks them. CISA's guidance: MFA is the single most effective control against phishing credential theft.
Run a malware scan if you clicked a link or downloaded anything
Just clicking a link (without entering data) can install malware on unpatched systems. Run your antivirus/antimalware immediately. Windows Defender (built-in, free) is competent. Malwarebytes Free is a respected second-opinion scanner. Disconnect from your network first if you suspect ransomware.
Check for unauthorized account activity
Log into affected accounts and review: recent logins (unfamiliar locations/devices), email forwarding rules (attackers add these to silently monitor your email), connected third-party apps (revoke anything unrecognized), and sent mail (check if emails were sent without your knowledge).
Notify relevant parties if it was a work device
Report to your IT/security team immediately. Don't be embarrassed — don't wait. Work phishing attacks often target entire organizations. Your IT team needs to know now to check for lateral movement or data exfiltration. Early notification limits damage significantly.
Report the phishing attack
Forward phishing emails to [email protected] (Anti-Phishing Working Group) and to the impersonated company's abuse address. File a report at reportfraud.ftc.gov for financial phishing. If it involved government agency impersonation (IRS, SSA, USPS), report to that agency's inspector general.
Place a fraud alert if financial data was entered
If you entered credit card, bank, or Social Security number information: call one bureau to place a fraud alert — they notify the others. Equifax: 1-800-349-9960, Experian: 1-888-397-3742, TransUnion: 1-888-909-8872. A fraud alert requires lenders to verify your identity before opening new credit in your name.
Common Phishing Types
- Email phishing: Fake login pages for banks, Microsoft, Google, Amazon
- Smishing: Phishing via SMS — fake USPS delivery notices, bank alerts
- Vishing: Phone calls impersonating IRS, Social Security, tech support
- Spear phishing: Targeted attack using your real name, employer, or contacts
- CEO fraud / BEC: Business email compromise — fake executive wire transfer requests
️ Reduce Future Risk
- Use a password manager — it won't autofill on fake domains
- Enable MFA on every account that offers it
- Bookmark important sites; never follow links in emails
- Keep software and OS updated — patches close vulnerabilities exploited by drive-by downloads
- Google Safe Browsing and Microsoft SmartScreen are enabled by default in Chrome/Edge
Frequently Asked Questions
I just clicked a link but didn't enter anything — am I safe?
Probably, but not certainly. Simply clicking can trigger drive-by download exploits on unpatched browsers. Run an antivirus scan, check your browser extensions for anything new, and monitor accounts for unusual activity for the next 30 days.
The email looked exactly like my bank's emails — how did they do that?
Attackers clone real emails and use lookalike domains (e.g., chase-secure.com instead of chase.com). Always check the sender's actual email address, not just the display name. When in doubt, go directly to your bank's site by typing the address — never follow the link.
I entered my password on a phishing site days ago and just realized — is it too late?
It's not too late, but act immediately. Attackers don't always use stolen credentials instantly — many are sold in bulk on dark web markets weeks later. Change the password now, enable MFA, then check for damage: review login history for unfamiliar sessions, check for email forwarding rules the attacker may have added, look for connected third-party apps you didn't authorize, and review sent messages. If it was a financial account, call the institution directly and ask them to flag your account for suspicious activity. The window between credential theft and exploitation is often days or weeks — you may still be ahead of them.
Bitdefender blocks phishing links before you can click them
Real-time web protection flags fraudulent sites instantly — including lookalike login pages that steal your passwords. Perfect 18/18 AV-TEST score. About $8/month for up to 5 devices.