I clicked a scam link. What should I do right now?

It happens to careful people. What matters is what you do next. Work through the section that matches your situation.

If you only tapped the link

Close the page and the browser tab. Do not enter anything.
Do not tap “Allow notifications” or download anything if prompted.
If a file was downloaded, delete it without opening it.
Run your phone’s built-in security check, such as Google Play Protect, to scan for unwanted apps.

Usually, just visiting a page does little harm. The danger is in what you type or install next.

Change that password right away, on the real site, by typing the address yourself.
Change it anywhere else you used the same password. Use a unique password for each site.
Turn on two-factor authentication.
Check recent sign-ins and account activity for anything you do not recognise.

Call your bank or card issuer immediately, using the number on the back of your card.
Ask them to block the card and issue a new one.
Review recent transactions and dispute anything unfamiliar.
Watch your statements for small test charges over the next weeks.

Treat it as an emergency. The code lets someone sign in as you. Call your bank or the service now, change your password and review account activity.

Uninstall it from Settings.
Revoke any special permissions it asked for, such as accessibility or device admin.
Run a security scan and consider a factory reset if the phone behaves strangely.
Change important passwords from a different, clean device.

Forward scam texts to 7726 (SPAM) in the US and UK.
In the US, report at reportfraud.ftc.gov. In the UK, use Action Fraud.
Report phishing emails to your email provider.
If you lost money, also file a report with local police and your national cybercrime centre.

Scammers are professionals, and these messages are built to work on everyone. Acting quickly matters far more than how it happened.

Run links through LinkGuard before you tap. A few seconds up front can save hours of cleanup.