You clicked a scam link. Now what?

Escudo guide · Updated July 2026

First, breathe

Opening a link is not the same as handing over your money. On a modern iPhone, simply loading a scam page usually does nothing on its own. The danger is in what a page convinces you to do: type your details, read out a code, or download something. So the real question is not "did I click", it is "what happened after I clicked". Let that lower your heart rate before you do anything else.

Work out what you actually did

• You opened the page and closed it. No forms, no typing, no downloads. Your risk is low. Close the tab, delete the message and keep an eye out for follow ups.
• You entered card details. This is the one to move on fast. Go straight to the card steps below.
• You entered a password. Change it now, and anywhere else you used the same one.
• You were asked for a code from your bank or from a text. That code is a key. If you shared it, call your bank now.
• You installed an app or "security tool" it told you to. Delete it, and see the device steps below.

If you entered card details

1. Call your bank now, using the number on the back of your card or inside your official banking app. Not any number from the scam message.
2. Ask them to freeze the card and watch for charges. They can issue a new one.
3. Watch for a follow up call. Scammers who have your details often call next, posing as your bank's "fraud team", to squeeze out more. Hang up and call the bank yourself. Real banks are fine with you calling back.
4. Never move money to a "safe account". No bank ever asks this. Anyone who does is the fraud.

If you entered a password

1. Change that password now, from the official app or by typing the address yourself.
2. Change it everywhere you reused it. This is why reusing passwords hurts.
3. Turn on two step verification where you can, so a stolen password alone is not enough.

If you installed something or your phone feels off

1. Delete any app the page told you to install.
2. Restart the phone.
3. Check Settings for any unfamiliar profile or app with unusual permissions, and remove it.
4. If anything still feels wrong, take the phone to an official Apple Store or your carrier.

Watch for the second wave

Falling for one scam often marks you for the next. If you entered details, expect a follow up in the coming days: a phone call from the "fraud team", another text, even a friendly person offering to help you "recover" what you lost for a fee. This is the recovery scam, and it targets people who have already been hit once. Treat any unexpected contact about the incident as suspicious, especially if it arrives fast. The rule does not change: hang up, and reach your bank or the police yourself through a number you looked up, never one that was given to you.

Report it

• Report it to the FTC at ReportFraud.ftc.gov, and forward the scam text to 7726 (it spells SPAM).
• If your identity may be misused, see IdentityTheft.gov for a recovery plan.
• For an after the fact report you can also call your local police non-emergency line. Call 911 only if someone is in immediate danger.
• Keep the message as evidence until you have reported it. Do not delete it in a panic.

Which scam was it?

Knowing the type helps you guess what they are after next. If it claimed to be your bank or a Zelle fraud alert, see the fake bank text. If it was a package fee, see the USPS package fee scam. And if a "family member" is asking for money, read the Hi Mom and family emergency scam before you send a dime.

You are not the problem

These pages are built to catch clever people on a distracted day. The fact that you went looking for what to do means you caught it in time. The people most at risk are the ones who never search, often our parents and grandparents. To see the machine behind all of this, read how SMS scam gangs actually operate.

That is what the Escudo app is for: it helps filter known scam patterns on the iPhone and sets them aside before they are read, so there is less to click in the first place. It does not promise to stop every scam or judge any single message, and it cannot tell you whether one specific message is a real threat. Nothing is deleted, it is only moved to a junk folder, and your messages never leave your phone.