You tapped a scam link. Now what?

Escudo guide · Updated July 2026

First, breathe

Opening a link is not the same as handing over your money. On a modern iPhone, simply loading a scam page usually does nothing on its own. The danger is in what a page convinces you to do: type your details, read out a code, or download something. So the real question is not "did I tap it", it is "what happened after I tapped it". Let that lower your heart rate before you do anything else.

Work out what you actually did

• You opened the page and closed it. No forms, no typing, no downloads. Your risk is low. Close the tab, delete the message and keep an eye out for follow ups.
• You entered card details. This is the one to move on fast. Go straight to the card steps below.
• You entered a password. Change it now, and anywhere else you used the same one.
• You were asked for a code from your bank or from a text. That code is a key. If you shared it, call your bank now.
• You installed an app or "security tool" it told you to. Delete it, and see the device steps below.

If you entered card details

1. Call your bank now, using the number on the back of your card or inside your official banking app. Not any number from the scam message.
2. Ask them to freeze the card and watch for charges. They can issue a new one.
3. Watch for a follow up call. Scammers who have your details often ring next, posing as your bank's "fraud team", to squeeze out more. Hang up and call the bank yourself. Real banks are fine with you calling back.
4. Never move money to a "safe account". No bank ever asks this. Anyone who does is the fraud.

If you entered a password

1. Change that password now, from the official app or by typing the address yourself.
2. Change it everywhere you reused it. This is why reusing passwords hurts.
3. Turn on two step verification where you can, so a stolen password alone is not enough.

If you installed something or your phone feels off

1. Delete any app the page told you to install.
2. Restart the phone.
3. Check Settings for any unfamiliar profile or app with unusual permissions, and remove it.
4. If anything still feels wrong, take the phone to an official Apple Store or your mobile provider.

Watch for the second wave

Falling for one scam often marks you for the next. If you entered details, expect a follow up in the coming days: a phone call from the "fraud team", another text, even a friendly person offering to help you "recover" what you lost for a fee. This is the recovery scam, and it targets people who have already been hit once. Treat any unexpected contact about the incident as suspicious, especially if it arrives fast. The rule does not change: hang up, and reach your bank or the police yourself through a number you looked up, never one that was given to you.

Report it

• Report to Action Fraud at actionfraud.police.uk or 0300 123 2040. In Scotland, report to Police Scotland on 101.
• Forward the scam text to 7726 free of charge, it spells SPAM on the keypad.
• Keep the message as evidence until you have reported it. Do not delete it in a panic.

Which scam was it?

Knowing the type helps you guess what they are after next. If it claimed to be your bank or HMRC, see the fake bank text. If it was a parcel fee, see the parcel redelivery fee scam. And if a "family member" is asking for money, read the Hi Mum and family emergency scam before you send a penny.

You are not the problem

These pages are built to catch clever people on a distracted day. The fact that you went looking for what to do means you caught it in time. The people most at risk are the ones who never search, often our parents and grandparents.

That is what the Escudo app is for: it helps filter known scam patterns on the iPhone and sets them aside before they are read, so there is less to tap in the first place. It does not promise to stop every scam or judge any single message, and it cannot tell you whether one text is genuine. Nothing is deleted, it is only moved to a junk folder, and your messages never leave your phone.