Your thumb is faster than your brain. That is the whole problem. One second you’re reading a text about a held parcel, the next you’ve clicked on a scam link and a very convincing page is asking for your card number. Your stomach drops. Now what? Take a breath, because what you do in the next ten minutes matters far more than the tap itself. This guide walks you through every step, in order, using the numbers UK banks and police actually use in 2026.
Clicked a Scam Link at a Glance
| Typed nothing in? | Close the page and run an antivirus scan — you’re usually fine |
| Entered a password? | Change it everywhere it’s used, starting with your email account |
| Entered card or bank details? | Call your bank on 159 (call cost varies) or the number on your card |
| Report a scam text | Forward it free to 7726 |
| Report a scam email or screenshot | Send it to report@phishing.gov.uk |
| Lost money? | Report Fraud on 0300 123 2040 (Scotland: Police Scotland on 101) |
| In the weeks after | Watch your statements; Cifas Protective Registration costs £30 for 2 years |
The Tap That Makes Your Stomach Drop
Jamie, a warehouse supervisor in Derby, was in the canteen at 12.50pm when a text told him a £1.49 fee was holding his parcel. New trainers were genuinely on the way, so he tapped. Here’s the part nobody tells you: on an up-to-date phone, tapping a link rarely causes damage on its own. The page that opens is the real trap. It exists to collect whatever you type into it, which is why it looks so polished. Scam pages copy couriers, banks and government sites almost pixel for pixel, and the fake Royal Mail delivery fee text is the classic example. You’re in huge company too: Ofcom found 40% of UK mobile users had received a suspicious message in just three months.
The First 60 Seconds
Type nothing. That is the single rule that decides how bad this gets. Close the tab or press back, and don’t touch any button on the page, however official the wording sounds. Never call a phone number shown on screen either, because scammers answer those. Before you close it, note the web address or take a screenshot, since you’ll want it for reporting. If a file has started downloading, cancel it, switch on airplane mode and delete the file without opening it. Jamie got as far as the card number box, felt something was off and stopped. The same trick powers the fake HMRC refund text: a small, believable request, then a form that wants everything.
If You Typed in a Password
Change it now, from a device you trust, before you do anything else. Start with your email account, because whoever controls your inbox can reset almost every other password you own. Then change it on every site where you’ve reused the same password, since criminals feed stolen logins into other services within hours. This is the National Cyber Security Centre’s core advice, and it works even if you’re not sure how much you typed. Pick something long and different for each account, and let your phone’s password manager remember it for you. While you’re at it, it’s sensible to check if your email was in a data breach, because a password that’s already leaked elsewhere makes this kind of attack far easier.
If You Entered Card or Bank Details
Ring your bank straight away and be honest about exactly what you typed. Dial 159, the safe line that connects customers of 26 UK banks, including Barclays, HSBC, Lloyds, Monzo, Nationwide, NatWest and Santander, to their real fraud team. The call isn’t free, and the cost varies by provider, so the number on the back of your card works just as well. Your bank can freeze the card, reissue it and flag the account. Don’t relax once that’s done. When Which? entered test details on a fake courier site, criminals began firing unauthorised charges of over £4,000 at the card, starting two weeks later. And if you realise you gave a scammer your bank details in full, remember one thing: a real bank will never ask you to move money to a “safe account”.
Give Your Device a Once-Over
With the urgent calls made, look at the device itself. Run a full antivirus scan, which is the NCSC’s official advice after any dodgy click; on Windows that’s Start, Windows Security, Virus & threat protection, then Full scan. Install any waiting updates for your phone or computer, because updates patch the exact holes drive-by downloads rely on. Android users should open Settings, then Apps, and delete anything they don’t remember installing, as some scam pages push an install file from outside Google Play. iPhones are rarely infected, but update iOS anyway. Ofcom adds that if you did install something, contact your mobile provider and avoid your banking apps until the phone is clean. Finally, switch on two-factor authentication for email and banking.
Report It So the Link Dies
Reporting feels pointless when you’ve lost nothing, but it’s how these pages get killed. Forward the text free to 7726, which sends it to your mobile network so the number can be investigated and blocked. Email a screenshot of the message, or the dodgy email itself, to report@phishing.gov.uk, and paste the web address into the scam website form on ncsc.gov.uk. This machinery genuinely works: the National Cyber Security Centre had removed 454,800 scam URLs by July 2026, most of them flagged by ordinary people. Every report shortens a scam page’s life and protects the next person who taps. For the full walkthrough, including iPhone and Android steps, see our guide to how to report a scam text with 7726.
If Money Has Already Left Your Account
Speak to your bank first, because it can sometimes stop or recall a payment that’s still moving. Then report the crime to Report Fraud, the national service that replaced Action Fraud in January 2026. You can file online at reportfraud.police.uk any time, day or night, or call 0300 123 2040 between 8am and 8pm, Monday to Friday. You’ll get a crime reference number, which your bank may ask for, and your report joins the intelligence picture police use to catch organised gangs. Scotland works differently: report to Police Scotland on 101 instead. Keep every text, email and statement entry as evidence. We’ll cover what happens after you report to Report Fraud, step by step, in a separate guide soon.
The Weeks After the Click
Scammers play a long game, so stay alert once the panic fades. Watch your statements for tiny “test” payments of a pound or two, which criminals use to see whether a stolen card still works. Expect a possible phone call from a fake “bank fraud team” that quotes the very details you typed, and expect more scam texts now your number looks live. It’s wise to look over your credit report for searches or accounts you don’t recognise. If your name, address and date of birth went into that form, Cifas Protective Registration puts a warning flag on your identity for £30 over two years, making lenders run extra checks. A stronger option is to freeze your credit file entirely.
Where Jamie’s Lunch Break Ends
Jamie closed the page, forwarded the text to 7726 and finished his sandwich with his heart still thumping. Nothing came of it, because he typed nothing. If you’ve clicked on a scam link, that’s the honest lesson: the tap is a moment, not a disaster, and the ten minutes afterwards decide everything. Save 7726, 159 and 0300 123 2040 in your phone this week, before you ever need them in a hurry.
Frequently Asked Questions
Can clicking a scam link infect my phone by itself?
Rarely, if your phone is up to date. The bigger danger is typing details into the fake page or installing an app it offers. Run an antivirus scan anyway.
What should I do first after clicking a scam link?
Enter nothing, close the page and note the web address. Then change any password you typed, call your bank if card details went in, and run a scan.
I entered my card details on a scam site — what now?
Call your bank on 159 or the number on your card immediately. It can block and reissue the card. Keep watching statements, as fraud attempts can start weeks later.
Is 159 free to call?
No. Stop Scams UK says the cost varies by phone provider, often the same as a national rate call. It connects customers of 26 UK banks to their fraud teams.
Do I need to worry weeks after clicking a scam link?
Stay watchful for about two months. Which? found fraud attempts began two weeks after details were entered, and follow-up calls from fake bank staff are common. Check statements regularly.
Disclaimer: This article is general information, not financial or legal advice. If you have been scammed, contact your bank and the official services named above. Figures and contact details were correct as of September 2026.