Entered your details on a phishing site: what to do right now

First: what exactly did you enter?

The most urgent step depends on what the scammer now has. Find the row that fits you. If more than one does, work from the top down.

1. Card: freeze or cancel it within minutes

• Open your bank's app and freeze or cancel the card. Most banks offer this in the card settings, and a frozen card can usually be unfrozen later if you change your mind.
• No app? Call your bank on the number on the back of your card or on its official website – never a number from the text or email that sent you to the fake site.
• If you cancel the card for good, the bank will send a new one with a different number. That's what you want: the scammer has the old one.

In the US, the FTC says to report a lost or stolen card right away by phone or app and then follow up in writing. For credit cards, it states that if only your card number was taken (you still have the card), you aren't responsible for unauthorised charges. For debit cards, the clock matters: reported within two business days of finding out, the most you can lose is $50; later than that, up to $500 – and after 60 days from your statement, possibly everything taken.

2. Online banking: call your bank and check every payment

• Call your bank (again, on a number you look up yourself), say you typed your login into a phishing site and ask them to block access and set up new credentials. The NCSC's advice is simple: if you shared banking details, contact your bank.
• Look through your accounts and cards, including pending and on-hold transactions – they show up before money actually leaves.
• If the "bank" or "support" got you to install a remote-access app on your phone or computer, disconnect the device from the internet and tell your bank. The scammer may still be able to control it.

3. Passwords: change them where it hurts most

• Change the password you entered on the account it belongs to. Open the official app or type the web address yourself – don't use any link from the message.
• Change it everywhere you used the same password. The NCSC also suggests switching to a passkey where the service offers one.
• Email first. Whoever controls your email can reset passwords for almost everything else. After changing it, sign out of all other devices and check for forwarding rules or a recovery phone number you didn't add. Our guide to a hacked account walks through this step by step.
• Turn on two-step verification (a code from an app or a prompt on your phone). For a new, strong password you can use our password generator.

4. Check your device

If you downloaded or opened anything from the fake site, the FTC and the NCSC both recommend updating your security software, running a full scan and removing anything it flags. If the message arrived on a work laptop or phone, the NCSC says to tell your IT department straight away – the attackers may be after your employer, not just you.

5. Report it – and keep the evidence

• The scam message: in the UK, forward scam emails to report@phishing.gov.uk and scam texts to 7726; report the fake website through the NCSC's form. In the US, forward phishing texts to 7726 (SPAM), send phishing emails to reportphishing@apwg.org and report the scam at ReportFraud.ftc.gov.
• Lost money or a hacked account: in England, Wales and Northern Ireland, report it to Report Fraud (0300 123 2040); in Scotland, call Police Scotland on 101. In the US, report to the FBI's Internet Crime Complaint Center (IC3). Elsewhere, contact your local police.
• Evidence: don't delete anything. Keep the message (with the sender's number or address), the web address of the fake site, screenshots and a list of suspicious payments. Your bank and the police will need them.

Personal details and ID documents

If you entered your date of birth, address or a photo of your ID, your money isn't directly at risk – but the details can be used for further scams and for opening accounts in your name. Expect follow-up calls from a "bank", the "police" or a "courier" who know your name and address – that's exactly what makes them convincing. Always check by calling the official number yourself.

In the US, if you gave out your Social Security, credit card or bank account number, the FTC points you to IdentityTheft.gov, which gives specific steps depending on what was exposed.

Next time: check the link before you open it

Phishing texts and emails imitate delivery companies (see Parcel delivery scam text), banks and online marketplaces, and their links often lead to domains that only look like the real name. You can take a suspicious link apart without opening it with our link checker – it shows the real domain and the usual tricks. For a suspicious email, the email header analyzer shows whether it really came from who it claims. Sign in to your bank only through its app or an address you type yourself. Paid a shop that never delivered? See Fake online shop: paid but nothing arrived. Got a follow-up call from your "bank" asking you to move money or read out a code? See A fake bank called me.