Recovery action: I Already Opened It
Pre-click decision
Was the link expected? Do you independently know the sender and destination? Is the message asking for a password, code, payment, identity detail, download, or urgent action? If any answer is uncertain, do not open it. End the conversation if pressure continues.
A link can look familiar without being genuine
Misspellings, extra words, unfamiliar domains, disguised buttons, and shortened destinations can hide where a link goes. The published illustration must use a nonfunctional reserved example such as example.invalid; it is not a scanning tool and cannot certify a URL as safe.
Verify through a different path
Type the known address yourself or open the official app. Contact a known person through a previously established channel. The FTC phishing guide and CISA Secure Our World provide broader prevention guidance.
If you already opened it
- Clicked only: close the page; update and scan the device using trusted tools if warranted.
- Downloaded something: do not run it; use trusted security guidance or support.
- Entered credentials: go directly to the genuine service, change affected credentials, review sessions, and enable MFA where available.
- Entered payment or identity data: contact the provider or relevant official recovery service through a known channel.
Report the conversation when appropriate, but do not assume the platform can reverse outside account or payment activity.
Next steps: Scam Signals · Protect Personal Information · Report Someone
What does not verify a link
A familiar logo, professional design, HTTPS icon, shortened address, urgent countdown, or live person on camera does not prove that a destination is genuine. Nor does a screenshot showing someone else logged in. Verification means leaving the message path and using a contact point or address independently known to belong to the real organization. If that cannot be done, treat the request as unverified and do not enter information.