Skip to content

kaval guide

I Clicked a Phishing Link. What Should I Do Now?

Clicked a suspicious link by mistake? Here is what to do in the first 10 minutes, what to check next, and when to report cyber fraud.

Ask Kaval about thisFree to start. Nothing to install.

Anuranjan Vikas5 min read

In this guide
  1. First, what did you do after clicking?
  2. If it was a bank or KYC message
  3. Check for account damage
  4. What to save as evidence
  5. Should you reset your phone?
  6. How Kaval can help
  7. Quick checklist

If you clicked a phishing link, do not panic. Close the page, do not enter any more details, disconnect from the site, change the password for the account involved, and turn on two-factor authentication. If you entered payment details, OTPs, banking passwords, or UPI PINs, call your bank and report the incident on cybercrime.gov.in or the Indian cybercrime helpline 1930 right away.

The first few minutes matter because most damage happens after the click, not from the click itself. A phishing page usually wants you to do one of three things: type a password, share an OTP, download an app, or approve a payment. Your job is to stop that chain quickly.

Here is the calm version of what to do.

First, what did you do after clicking?

The right response depends on what happened next.

If the page opened and you closed it without entering anything, the risk is lower.

Do this:

Most modern phones and browsers are hard to compromise from a single page view. The bigger risk is that the page looked real enough to get you to type something.

You typed a password

Change that password immediately. Start with the account the page was pretending to be, then change the same password anywhere else you reused it.

Priority order:

  1. Email account
  2. Bank or payment app account
  3. Social media accounts
  4. Shopping accounts with saved cards
  5. Work accounts

If the password was reused, assume every reused account is at risk. Attackers try leaked passwords on Gmail, Instagram, Amazon, banking portals, and cloud storage within minutes.

You typed an OTP, UPI PIN, card PIN, or CVV

Treat this as urgent.

Call your bank or payment app support from the official app or official website. Do not call a number from the suspicious message. Tell them you may have shared a code or PIN on a phishing page.

Also report the incident on cybercrime.gov.in or call 1930 if money was moved or you suspect financial fraud. The official National Cyber Crime Reporting Portal says complaints should include accurate details for prompt action, and lists 1930 as the cybercrime helpline.

You installed an app

This is the riskiest version, especially if the scammer asked you to install a screen sharing app, APK file, “support” app, “KYC update” app, or SMS forwarding app.

If the file was an Android APK, use this dedicated fake APK cleanup guide after you disconnect the phone.

Do this now:

NPCI’s UPI safety guidance specifically warns users not to download screen sharing or SMS forwarding apps when asked by unknown people. That advice is worth taking seriously.

If it was a bank or KYC message

Fake KYC messages are common because they create panic. The message usually says something like:

Dear customer, your SBI account will be blocked today. Complete KYC now: [link]

The Reserve Bank of India has warned that KYC fraud often uses calls, SMS, or emails that create false urgency and push people to share login details, card information, PINs, OTPs, or install unverified apps. RBI’s advice is simple: contact your bank directly through official sources, do not click suspicious KYC links, and report financial cyber fraud quickly.

That means:

If the bank really needs KYC, it will be visible through official channels. It will not need your OTP over a random link.

Check for account damage

After you have changed passwords and reported urgent money risk, check for signs that someone got in.

Look for:

Email forwarding rules are easy to miss. If attackers get into your email, they often create a hidden forwarding rule so they keep seeing your password reset emails after you change the password.

What to save as evidence

Before deleting anything, take screenshots.

Save:

You may need this for your bank, cybercrime complaint, or local police station.

For a clearer reporting path, see our guide on how to report cybercrime online in India.

Should you reset your phone?

Usually, no. If you only opened a phishing page, a full reset is overkill.

Consider a phone reset if:

If you reset, back up photos and important files first. Do not restore suspicious apps from backup.

How Kaval can help

Send the suspicious link, SMS, WhatsApp message, or screenshot to Kaval. Kaval can check if the link is risky, explain what the scam was trying to do, and give the next step.

For example:

Unsafe. Do not open it again. The link is not an SBI domain and redirects to a fake login page. Since you entered an OTP, call your bank now and report it on 1930.

That is the kind of answer you need after a scare: not a lecture, just the next move.

Quick checklist

Clicked links are common. The mistake is not clicking once. The mistake is waiting after you realize something is wrong.