Write down the sequence accurately
Fictional example: Luca opens what appears to be a parcel tracking link. The page requests a card payment, so he immediately closes it. He entered nothing and approved nothing. His note therefore says “opened page, saw payment form, closed page”, rather than “bank account hacked”.
Record the time, type of message and visible address when these are already available. Do not click again merely to complete the evidence. An existing screenshot or original message is enough to begin with. Avoid clearing browser history if workplace IT may need it to investigate.
Separate four different situations
Check whether you entered a password or verification code, disclosed payment details, downloaded a file or ran an application. Downloading is not the same as installing. Granting permission for browser notifications is another distinct event; it does not itself establish that an email account was taken over.
Simply visiting a page does not exclude every technical risk, particularly where vulnerabilities are involved. However, that visit alone does not prove infection. The sequence, existing protection and observed signs matter. Describe uncertainty openly instead of replacing gaps in memory with assumptions about what must have happened.
Make focused checks on the device
Open the browser’s download list without launching unknown files. Use its ordinary settings to see whether you allowed notifications from the website, and remove unwanted permission. Work through those settings, not through a supposed repair button displayed by the suspicious website.
Install available operating system and browser updates through familiar settings. A suitable scan using existing protection or software obtained from a trusted source may help. Do not download a security helper from a warning advertisement. A clear scan offers information, but cannot guarantee that every possible problem is absent.
Respond to any additional action
If you entered login details, reach the genuine provider through a known route and secure the affected account. If card or bank details were disclosed, contact that provider promptly through verified contact channels. Describe precisely which information may have been exposed and follow its specific instructions.
If you ran an unfamiliar program or have a concrete reason to suspect infection, disconnect the device from networks and use another trusted device for sensitive logins. Seek technical assistance. On a work device, inform the responsible IT team before deleting data or resetting the system yourself.
Finish with a clear next step
Luca checks downloads and notification permissions, updates his browser and retains the message for reporting. Because he entered no information, he does not tell his bank that confirmed account access occurred. He does know which new signs would justify further investigation.
Record what has been checked and what remains uncertain. A calm, relevant sequence is more useful than changing every setting at random. This guidance does not replace technical investigation where malware is genuinely suspected; the device and the actions taken may make additional measures necessary.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Must I change every password after any click?
Not automatically. Entered information, possible malware execution and signs of unauthorised access matter. Secure affected passwords and any accounts where the same password was reused.
Does a pop-up prove my device is infected?
No. A website can simply display a frightening warning. Do not use its offered phone number or repair software; check through known settings and trusted assistance.
Should I immediately restore factory settings?
A click alone does not justify that step. Resetting may remove data and evidence. With a concrete infection concern, ask suitable technical help to plan the response.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- BACS: Phishing, Vishing, SmishingSource review date:
- BACS: Gerät infiziert – Was nun?Source review date:
- BACS: Geräteschutz, Passwörter und ZugriffsschutzSource review date:
