Clicked a scam link? What to do depends on what you did next

Illustrative stock image via Unsplash. It does not depict the organisations named.

Opening a scam link is not always harmless, and it does not always infect your phone. What matters is what happened after the click: did you type a password, share card details or an OTP, approve a payment, install an app or let someone see your screen?

01 / Find your case

Most scam links are built to get you to do something next. The UK's National Cyber Security Centre (NCSC) says a scam link takes you to a site that might download a virus or steal your passwords or other personal details. RBI warns of links made to extract confidential details, and of apps that give fraudsters access to your phone. So start with what you did after the click.

• Opened it, typed nothing, installed nothing: section 02.
• Typed a password: section 03.
• Typed card or UPI details, or shared an OTP: section 04.
• Approved a payment or a collect request: section 05.
• Downloaded or installed an app or APK file: section 06.
• Let someone control your phone or see your screen: section 07.

Did more than one thing? Follow every section that applies, starting with the one closest to your money.

02 / You only opened it

You may be fine, but do not assume it. Browsers do have flaws that a crafted web page can exploit. CERT-In's note of 1 October 2026 on Google Chrome, for example, says attackers could exploit the flaws it lists by getting a victim to open a specially crafted web request. The fix in such cases is the update.

• Close the page. Do not type anything into it and do not tap its buttons.
• If a file downloaded, do not open it. Delete it.
• Update your browser and your phone. Google says Chrome on Android updates through the Play Store, and CERT-In's advice for these flaws is to apply the vendor's update.
• Report the link on Chakshu (section 08), so others are warned.

Not sure the link was a scam? See how to check a number, link, app or UPI ID.

03 / You typed a password

• Change it now, on the real app or website. Type the address yourself or open the app. Do not use the link again.
• Change it everywhere you reused it. The NCSC says to change the password on any account that uses the same one.
• Check your email settings if it was your email password. The NCSC warns that criminals often add a forwarding rule to a hacked mailbox, which lets them reset your other passwords. Google also says to remove any filters or forwarding rules you did not set up.
• Turn on two-step verification (2SV, also called 2FA). The NCSC and Google both say it keeps criminals out even if they know your password.
• Sign out devices you don't recognise. Google lets you see every device signed in to your account and sign out the ones you are not sure about. The NCSC also advises logging all devices out.

If it was your WhatsApp, Instagram or Facebook, follow our guides for a hacked WhatsApp and a hacked Instagram or Facebook account.

04 / You typed card or UPI details, or shared an OTP

• Call your bank now and ask it to block the card, UPI and net banking. Use the number on its official website, app or card, or our bank helpline list. RBI warns that numbers found through search engines may be fake.
• Do it even if no money has gone yet. RBI's 2017 rules require banks to offer 24x7 ways to report fraud and block a card. They say the longer you wait to tell your bank, the higher the risk of loss.
• Do it even if you typed the details yourself. Under the same rules, any loss after you report it falls on the bank. Mint, reporting a Kerala High Court case in which a customer had shared an OTP, also says prompt reporting helps limit further losses.
• Put it in writing afterwards and keep the complaint number. Under today's rules, Mint notes, reporting a third-party breach within three working days gives you zero liability.

An OTP can approve more than a payment. If the OTP was for a WhatsApp code, see the WhatsApp guide.

05 / You approved a payment or a collect request

If you entered your UPI PIN, money has probably gone. RBI and NPCI both say you never need to enter a PIN or scan a QR code to receive money. A 'collect request' that asks for your PIN is a request to pay.

• Call 1930 now, then report on cybercrime.gov.in. The government says 1930 helps victims report quickly and, where possible, get fraudulent transactions frozen.
• Then call your bank and block UPI.
• Follow what to do in the first hour after a UPI fraud, or answer three questions in our money-lost checklist.

Paid a real person by mistake rather than a scammer? That is a different route: see sent money to the wrong UPI ID.

06 / You downloaded or installed an app or APK file

This is the most serious case. An installed app may be able to read your messages and OTPs. Make your calls from another phone.

• Take the phone offline: flight mode, or switch off Wi-Fi and mobile data. CERT-In says one such app, SpyMax, sends what it steals to its operators' server and takes commands from it. A removal sequence from the firm CloudSEK, published by MediaNama, starts with this step.
• Call your bank and block UPI, net banking and cards. If money has gone, call 1930 first.
• Remove the app in Safe Mode. I4C's advisory of March 2026 says Safe Mode switches off third-party apps, which gets around their attempts to block removal. CloudSEK's sequence says the same. Google says the way to start Safe Mode varies by phone. Then check Device admin apps and Accessibility for anything you don't recognise.
• Factory reset if it comes back, I4C advises.

Our guide to apps installed from a link or ad has every step in order, including the call-forwarding check.

07 / You gave remote access or shared your screen

RBI warns that fraudsters lure people into downloading apps that can access all the data on their phone or computer. Anyone who watched your screen may have seen your PINs, passwords and OTPs.

• End the session and the call. Turn off the internet.
• Call your bank from another phone and block UPI, net banking and cards. If money has gone, call 1930 first.
• Uninstall the app you were asked to install. If it will not go, follow section 06. The NCSC says a factory reset is the safest fix for a phone you think is infected.
• Change your passwords and PINs from a different, trusted device, as in section 03.

08 / Report it, even if nothing happened

• No money lost: report the link or message on Chakshu on Sanchar Saathi. It has an option for suspected web links, and asks for reports within 30 days. The government's figures for Chakshu include a 'malicious link / website' category.
• Money lost: Chakshu is not the place. Sanchar Saathi itself says to report at 1930 or cybercrime.gov.in.

Keep screenshots of the message and the page, and the time you clicked. Your bank and the police may ask for them.

09 / Confirmed vs. general advice

Confirmed (official documents): the Chrome flaws and the update advice, from CERT-In's note CIVN-2026-0486; the password, email-forwarding, 2SV and sign-out steps, from the NCSC and Google; the 24x7 reporting duty, the warning about delay and the rule that losses after reporting fall on the bank, from RBI's circular of 6 July 2017; the PIN and QR rule, from RBI and NPCI (whose site blocks automated checks, so we read it in a browser on 30 October 2026); the Safe Mode and reset steps, from I4C's advisory TAU/ADV/012; the SpyMax behaviour, from CERT-In; Chakshu's link reporting and 30-day window, from Sanchar Saathi; 1930's role, from PIB.

Reported (media): CloudSEK's removal sequence (MediaNama); the Kerala High Court case and the three-working-day rule (Mint). General advice, not an official rule: closing the page and deleting an unopened download. We do not say every click infects a phone, or that a click is always harmless. Nobody can tell that from the outside, so act on what you did after the click.