You just realized you did it. You clicked a link in a text, or an email, or a QR code. You entered your username and password. Maybe you even typed in a verification code. And then something felt off — the page reloaded strangely, or you got a weird error, or you just had that sinking feeling in your stomach.
Now you're staring at your phone or computer, heart pounding, thinking: What do I do now?
First: breathe. You're not alone, and you're not stupid. Scammers are professionals. They spend hours crafting these pages to look exactly like the real thing. The fact that you caught it — even if it's after the fact — means you're already ahead of where many victims are.
Second: act fast, but act calmly. The first hour after you've given your login to a scam site is the most critical window. The scammer will try to move quickly — they want to change your password, lock you out, and drain accounts before you notice. Your speed is your best defense.
Here's exactly what to do, step by step, in that first hour.
Step 1: Change your password immediately — but do it right
This is your top priority. If you gave away your password to a fake site, the scammer now has it. They may try to log in within minutes.
Go directly to the real website — not through the link you clicked, but by typing the official URL into your browser or using the official app. Change your password to something new, strong, and unique.
Important: If the scam site asked for your username/email and password, and you use that same password anywhere else, change it there too. Scammers will try that combination on other popular sites — banking, email, social media, shopping.
If you use a password manager: Let it generate a new, strong password. Don't reuse an old one.
If you can't log in because the scammer already changed your password: go to the "forgot password" or account recovery option immediately. Use your recovery email or phone number to reset it. Act before the scammer changes those recovery options too.
Step 2: Enable two‑factor authentication (if you haven't already)
If you didn't have two‑factor authentication (2FA) on the account, turn it on now. This adds an extra layer — even if the scammer has your new password, they'll need a code from your phone or authenticator app to get in.
If you already had 2FA enabled and you gave away a verification code to the scam site, that means they used it to log in. In that case, after you change your password, revoke all active sessions — most services have a setting that lets you "sign out everywhere" or "revoke all devices." This kicks the scammer out immediately.
Step 3: Check your account for changes
Once you've secured your login, look around.
Check your profile and settings: Did they change your email address, phone number, or recovery options? If so, change them back immediately.
Check recent activity: Many services show recent logins or devices. Look for anything you don't recognize and revoke it.
Check for any transactions or orders if it's a financial or shopping account. If you see something suspicious, note it down.
Step 4: Call your bank and credit card companies — even if you didn't enter card info
This is critical. Even if the scam site only asked for your login and not your credit card number, the scammer may now have access to payment methods stored in that account (like saved cards on Amazon, PayPal, or your bank's portal).
Call the fraud department of your bank and any credit card issuers. Use the number on the back of your card — not a number from an email or text. Tell them:
"I may have given my login credentials to a phishing site. Please monitor my accounts for suspicious activity and consider issuing new card numbers."
If you have accounts linked to that login (like Venmo, PayPal, or Zelle), call those services too.
If you entered your Social Security number or driver's license on the scam site, tell the bank that as well. They can place additional fraud alerts.
Step 5: Place a fraud alert on your credit reports
If you gave away any personally identifiable information — especially your Social Security number, date of birth, or address — you should place a fraud alert on your credit reports.
Contact one of the three major credit bureaus (Equifax, Experian, or TransUnion). When you place a fraud alert with one, they are required to notify the other two.
A fraud alert makes it harder for identity thieves to open new accounts in your name. It lasts for one year and is free.
Step 6: Scan your device for malware
If the scam site asked you to download anything — an app, a file, or a "security tool" — don't open it. Delete it immediately. Then run a full antivirus or malware scan on your device.
If you didn't download anything, but you visited a suspicious page, it's still a good idea to run a scan. Some fake sites try to install malware automatically (drive‑by downloads), though modern browsers often block those.
Step 7: Report the scam
Reporting helps others — and it may help you if you need to dispute charges or prove identity theft.
Report to the FTC: File a report with the Federal Trade Commission. They collect scam data and use it to track patterns.
Report to the platform: If the scam came through a text, email, or social media, report it to that platform (e.g., forward spam texts to 7726, report phishing emails to your email provider).
Report to the impersonated company: If the scam site pretended to be your bank, a retailer, or a government agency, let the real company know. They may have a dedicated fraud team that can take down the fake site.
Step 8: Write down everything you did
This may feel tedious, but it's important. Write down:
The time you clicked the link.
The URL of the fake site (if you can still see it).
What information you entered (password, SSN, card number, etc.).
Any confirmation numbers or error messages you saw.
The steps you've already taken (password change, calls made, reports filed).
This record will help if you need to file police reports, dispute charges, or work with your bank's fraud department.
The first hour summary
Here's a quick checklist for that first hour:
Change your password — on the real site, not the fake one.
Enable 2FA and revoke all active sessions.
Check account settings — email, phone, recovery options.
Call your bank and credit card companies — use the number on your card.
Place a fraud alert on your credit reports if you gave up sensitive info.
Run a malware scan if you downloaded anything.
Report the scam to the FTC and the impersonated company.
Document everything — time, URL, info given, actions taken.
What not to do
Don't panic and delete everything without recording it. If you close the browser, delete the text, and clear your history, you may lose evidence that could help your bank or law enforcement.
Don't call the scammer back. If they left a phone number, don't call it. That number goes to them, and they'll try to scam you again — maybe posing as a "recovery specialist."
Don't feel ashamed. You are not alone. Scammers are professionals who practice these scripts every day. The important thing is that you caught it and you're acting.
A special note about financial accounts
If the account you compromised is a financial account — bank, credit union, investment, PayPal, Venmo, Zelle, Cash App — prioritize it above all others. Call them immediately. Ask them to:
Freeze or flag the account.
Review recent transactions.
Issue new account numbers if needed.
Place a note on your file about the compromise.
Many banks have 24/7 fraud lines. Don't wait until morning.
How long does it take?
If you follow these steps, you can secure most accounts within 30–60 minutes. The calls to your bank and credit card companies take the most time, but they're the most important.
After the first hour, you'll shift from emergency mode to monitoring mode. Check your accounts daily for the next few weeks. Keep an eye on your credit reports for any unauthorized activity.
What if you waited too long?
Maybe you're reading this hours or days after you entered your info. That's okay. Do the steps anyway. Some damage may have already been done, but you can still limit further harm. Scammers often wait — they may sit on your credentials for weeks before using them. Securing your accounts now is still a win.
No letters yet.