You tapped a scam link. Breathe.

Escudo guide · Updated July 2026

This guide is not about a particular scam. It is about the minute after you realise, when your stomach drops and you want to do ten things at once. So it is built as triage. Sort out how much trouble you are actually in first, then act only on the part that matters. Panic makes people delete evidence and miss the one call that would have helped, so the order here is deliberate.

Why the tap alone is usually harmless

Opening a link is not the same as handing over your money. On an up to date iPhone, simply loading a scam page tends to do nothing on its own. There is no lurking download, no instant drained account from a single tap. The danger lives in what the page then talks you into doing: keying in your details, reading back a code or installing a "tool". So the real question is never "did I tap it". It is "what did I do on the page after". Let that drop your heart rate a notch before you touch anything else, because your next few decisions are better made calm.

Work out what you actually did

• Opened it and closed it. No forms, no typing, no downloads. Your risk is low. Close the tab, delete the message and keep half an eye out for follow ups.
• Entered card details. This is the one that needs speed. Go straight to the card steps below.
• Entered a password. Change it now, and anywhere else you have used the same one.
• Read out a code from your bank or a text. That code is a key to your account. If you shared it, ring your bank now.
• Installed an app or "security tool" it told you to. Delete it, then see the device steps below.

If you entered card details

1. Ring your bank now, on the number on the back of your card or inside your official app. Never a number from the scam message.
2. Ask them to freeze the card and watch for charges. They can send a new one out.
3. Brace for the follow up call. Scammers holding your details often ring next, posing as your bank's fraud team, to squeeze out more or to talk you into moving money. Hang up and ring the bank yourself. A real bank is perfectly happy for you to call back.
4. Never move money to a "safe account". No bank on earth asks this. Anyone who does is the fraud, and that trap has its own walk through in the fake bank text guide.

If you entered a password

1. Change it now, from the official app or by typing the address in yourself.
2. Change it everywhere you reused it. This is the moment reusing one password across sites really bites.
3. Turn on two step verification where you can, so a stolen password on its own is not enough to get in.

If you installed something or the phone feels off

1. Delete any app the page told you to install.
2. Restart the phone.
3. Open Settings and look for any unfamiliar profile or an app with permissions it has no reason to hold, and remove it.
4. If it still feels wrong, take it to an official Apple Store or your mobile provider. Do not ring a "support" number the page gave you.

The second wave is the real risk now

Falling for one scam quietly marks you for the next. If you entered details, expect a follow up over the coming days: a call from the "fraud team", another text, even a friendly sort offering to help you "recover" what you lost, for a fee up front. That last one is the recovery scam, and it hunts people who have already been hit once, because their guard is down and their hope is up. The rule does not bend for any of it. Hang up, and reach your bank or the police yourself through a number you looked up, never one that was handed to you. This panicked minute is the same the world over, the same "acabo de dar clic, y ahora qué" that people search in Spanish and Portuguese, and the follow up wave works the same way in every language.

Report it, and keep the evidence

• Report to Action Fraud at actionfraud.police.uk or 0300 123 2040. In Scotland, report to Police Scotland on 101. Call 999 only if someone is in immediate danger.
• Forward the scam text to 7726, free, which spells SPAM on the keypad.
• Keep the message until you have reported it. Do not delete it in a panic, it is evidence.

Which scam was it, and what next

Knowing the type helps you guess what they will try next. If it wore your bank's name or HMRC's, see the fake bank text. If it was a parcel fee, see why the parcel scam only asks for a pound. And if a "family member" is the one asking for money, read the Hi Mum scam before you send anything. To understand who is on the other end and why the texts never quite stop, read how SMS scam gangs actually operate.

You are not the problem

These pages are built to catch clever people on a distracted day. The fact that you went looking for what to do means you very likely caught it in time. The people most at risk are the ones who never search, which tends to mean our mums, dads and grandparents.

That is where the Escudo app comes in. It filters known scam patterns on the iPhone and sets them aside in a junk folder before they are read, so there is less to tap in the first place. It does not promise to stop every scam or pass judgement on any single message, and it cannot tell you whether one specific text is genuine. Nothing is deleted, it is only set aside, and your messages never leave the phone.