If you tapped a link in a message and now doubt it, close the page at once and type nothing into it. Opening a link is usually far less dangerous than what comes next, so what you do in the first hour depends on what you did after the click: only looked, entered a password, entered card details, or downloaded something.
Clicked a suspicious link? What to do in the first hour
By Sure INSTANT team · · 8 minutes read
Opening a link is usually less dangerous than what follows. What to do in the first hour depends on what you entered after the click: the steps for each case, and a way to check the message text.
Try it now: Is it a scam? in Instant AI — paste the text of the message and see a risk score from 0 to 100; the preview is free, with no sign-up.
Is clicking the link dangerous on its own?
Scam pages normally depend on you handing something over: a password, a verification code, a card number, or permission to install an app. If you opened the page and closed it without typing, downloading or agreeing to anything, the damage is most likely limited. That is not a reason to ignore it. Install any pending update for your browser and your phone, keep an eye on your accounts for the next few days, and do not reply to the message.
The common mistake after a click is panic: calling the phone number written in the same message "to check", or tapping the "cancel this transaction" link that arrives a few minutes later. Both belong to the same trap.
What should you do in the first ten minutes?
- Close the page or the tab. Do not press any button inside it, not even "Cancel" or "Back".
- Take a screenshot of the message before you delete anything: the text, the sender and the time.
- Ask yourself calmly what you typed or agreed to after the link opened. Write the answer down.
- If you downloaded a file or installed an app, disconnect the device from the internet.
- Find your case in the table below and start with its first action.
Which action fits what you did?
| What you did after the click | First action | Within the hour |
|---|---|---|
| Only opened the page | Close it and do not reply | Update browser and system, watch your accounts |
| Entered a password | Change it on the official site | Sign out of all devices, turn on two-step verification |
| Entered a verification code | Call the organisation that holds the account | Review recent activity, ask them to stop what you did not do |
| Entered card details | Call your bank and ask to block the card | Check the statement and dispute anything unfamiliar |
| Downloaded a file or an app | Go offline and delete what you downloaded | Scan the device, change passwords from another device |
What if you entered your password?
Treat it as exposed from that moment. Open the official site or app by typing its address yourself, not through the link you received, and change the password. Then sign out of all devices if the account allows it, and turn on two-step verification.
If you use the same password anywhere else, change it there too. Start with your e-mail, because it is the key that resets every other account.
What if you entered card details or sent money?
Time matters more than anything else here. Call your bank on the number printed on the back of the card or through its official app. Ask them to block the card and to dispute every transaction you did not make. Note the time of the call and the case number. If you shared a verification code that came by text message, say so plainly, because it changes how the bank handles the case.
Nobody can promise you the money will come back, but an early report puts you in a better position. What you read here is general guidance, not financial or legal advice. Your bank and the body that handles fraud reports where you live are the authority on your case.
What if you downloaded a file or installed an app?
Take the device offline first. Delete the file without opening it, remove the app, and review the permissions you granted, especially access to messages, notifications and screen control. Run the security scan your system provides.
Then change your important passwords from another device you trust, not from the same one.
How can you tell whether the message really was a scam?
You may not be sure, and finding out helps in two ways. It tells you whether you need everything above, and it gives you a clear description to give the bank. Copy the text of the message as it arrived, paste it into Is it a scam?, and add the sender's name or number if you wish. The tool returns a risk score from 0 to 100, the reasons ordered by severity, and what to do now. The message is checked against fixed rules first, then by the AI engine, and the more severe of the two verdicts wins.
The result is prepared by an AI engine and must be reviewed before you rely on it. A low score does not prove a message is safe. And Instant AI only prepares: it does not call your bank, file a report or block the sender. If you want to learn the signs themselves, so you catch the next one before tapping, the guide on how to spot a scam message walks through them with examples.
What should you keep as evidence?
- The message itself: a screenshot showing the text, the sender and the time. Do not delete the conversation until your report is finished.
- The page address: copy it as text from your browser history, without opening it again.
- The transaction trail: screenshots of any charge or alert that arrived after the click.
- Your own timeline: when you clicked, what you entered, when you called the bank, and the case number.
How do you protect your business and the people around you?
If your work runs on a publicly listed phone number, as it does for a repair technician or a cleaning service, you receive messages and payment links from unknown numbers every day, and telling them apart is part of the job. Agree on one fixed way of paying with your customers. Do not open a "transfer receipt" that arrives as a link. Confirm that the money has arrived by looking at your own account. The page of tools for home services gathers what is useful for this kind of business.
What the free preview shows and what you pay for
The preview is free and needs no sign-up. The check really runs on your message, and you see the head of the result: the title, the verdict line and the first reason. The rest stays locked. Previews are limited to a few per day. If you sign in, you also get one full "Is it a scam?" verdict free every day, with no units. If the AI engine is not available, you are still given the verdict of the fixed rules, free of charge and labelled as basic.
When you pay, the same stored result is released without running again: every reason in order of severity and what to do now, with a copy button for each block and a PDF download you can keep with the rest of your evidence. The price starts from 2 US dollars for 10 analyses. The balance never expires.
Frequently asked questions
Can my phone be hacked just by opening the link?
Opening alone is not usually enough. The risk starts when you type details, download a file or agree to install something. Even so, install system and browser updates and watch your accounts for a few days. If the device starts behaving oddly, have a specialist check it.
Should I call the number in the message to check?
No. The number and the link in a suspicious message are part of it. Call the organisation on its official number, the one printed on your card or shown in its app, and type its web address yourself.
Is the "Is it a scam?" verdict enough to put my mind at rest?
Not by itself. The verdict is prepared by an AI engine together with fixed rules, it must be reviewed before you rely on it, and it is not legal or financial advice. If money or an important account is involved, act as if the message were a scam until the organisation itself confirms otherwise.
