A click alone is different from entering a password, downloading a file, approving a login, or giving someone remote control.
What this usually means
Pop-ups, browser redirects, unwanted programs, account alerts, and remote-access activity require different responses. Avoid calling numbers in warnings or installing another unknown cleanup tool.
Practical checks and decisions
Stop and note exactly what happened
Begin with “stop and note exactly what happened” as a controlled observation. For what to do if you clicked a suspicious link, change one thing at a time and record the exact result so a temporary symptom is not mistaken for the cause.
Change exposed passwords from a trusted device
Use “change exposed passwords from a trusted device” as a verification step, not a quick password swap. Choose a unique credential, remove recovery details you do not recognize, sign out other sessions, and record which accounts still depend on the same email address or phone number.
Check email and financial accounts for new activity
Before completing “check email and financial accounts for new activity,” confirm that you control the recovery email, phone, and authenticator. Save backup codes somewhere separate from the computer and never give a caller, pop-up, or remote technician a one-time verification code.
Scan the computer and preserve messages for follow-up
Treat “scan the computer and preserve messages for follow-up” as a decision point. The useful next step depends on what the check reveals, the age and condition of the device, and whether repair remains better value than replacement.
When a professional diagnosis makes sense
For what to do if you clicked a suspicious link, get help when money, passwords, email, remote access, or unfamiliar account activity may be involved. Preserve a timeline, avoid further contact with the suspected scammer, and make account changes from a trusted device.
For hands-on or remote help, review the related service, or browse the Help Center for another guide.
