Clicked a link in a scam text? What happens and what to do

If you only tapped the link

On an updated phone, opening a scam page and leaving without typing anything is low risk. Most scam texts are built to get you to hand over information. The FTC says they send you to “a spoofed website that looks real but isn’t,” and if you log in, the scammers “might steal your username and password.”

The word that matters is updated. You’ll still find older forum answers saying a tap alone can’t hurt an iPhone. Apple’s own support page, published in April 2026, says otherwise for phones that are behind. Security researchers found web-based attacks aimed at out-of-date iOS, and Apple wrote that if you “click a malicious link or visit a compromised website, the data on your iPhone might be at risk of being stolen.”

Apple was just as clear about who was safe: “If you have kept your iPhone software up to date, then you are already protected.” Devices with Lockdown Mode on were also protected from these attacks. Apple adds that Safe Browsing in Safari, on by default, blocks the malicious domains it identified.

On iPhone, check your version now. Open Settings > General > Software Update. As of October 2026, Apple lists these current releases:

Your iPhone	Update to	Notes
iPhone 11 or later	iOS 27.0.1, or iOS 26.7.1 if you stay on iOS 26	Both released September 28, 2026
iPhone XS, XS Max, XR	iOS 18.7.10	Released August 17, 2026
iPhone 8, 8 Plus, X	iOS 16.7.16	Released May 11, 2026
iPhone 6s, 7, SE (1st gen)	iOS 15.8.8	Released May 11, 2026
Anything still on iOS 13 or 14	iOS 15 at least	Apple says these must move to iOS 15 to get the fixes

If your phone can’t take any of these, Apple suggests turning on Lockdown Mode where it’s available. Our piece on whether the iPad 2 is still usable explains why devices that stopped getting updates carry more risk.

On Android, the same logic applies. Install any pending system and Chrome updates. Google hasn’t published an Android equivalent of Apple’s warning that we could find. The bigger Android risk is an app the page tricks you into installing, covered below.

If you typed in your details

This is where the scam pays off for them. The FTC’s word for when to report it is “immediately.” What to do depends on what you entered. These steps come from the FTC’s “What To Do if You Were Scammed” page (updated June 2026):

What you typed	What it lets the scammer do	First thing to do
Card number (credit or debit)	Make charges	Call the number on the back of the card and report it
Bank login	Move money, see accounts	Call your bank, then change the password
Password for any account	Log in as you	Change it, plus anywhere you reused it; turn on two-factor
Social Security number	Open accounts in your name	Go to IdentityTheft.gov
Paid a small “fee” (toll, redelivery)	Charge again; reuse the card	Report the charge to your card issuer and ask for a refund
Nothing	Very little	Update your phone, delete and report the text

For passwords, the FTC says to create a new, strong password for the compromised account, change it anywhere else you used it, and turn on two-factor authentication. If you’re already locked out, the FTC links to recovery steps for popular accounts on its hacked-account page.

For a Social Security number, the FTC splits it in two. If the scammer has used it, report it at IdentityTheft.gov and follow the recovery plan. If you’re not sure, use IdentityTheft.gov/databreach and follow its steps to protect yourself from identity theft. Our guide to what to do after a data breach notice letter covers the freeze in detail.

Federal law limits your losses for unauthorized credit and debit card use, the FTC says. Report it quickly.

If the fake page asked you for a verification code and you typed or read one out, treat that account as compromised. Change its password right away. A related scam is covered in what to do if someone asked for your Google Voice verification code.

If you downloaded or installed something

This is the riskiest case, and it works differently on each phone.

iPhone. One thing a web page can push to an iPhone is a configuration profile. Apple’s iPhone User Guide says profiles can be “downloaded from a webpage” and that iOS asks permission before installing one. Check Settings > General > VPN & Device Management. If you see a profile you don’t recognize and didn’t get from your employer or school, tap it and remove it. Apple notes that deleting a profile also deletes its settings, apps and data.

Android. A scam page may push an app file to install from outside Google Play. Google’s Pixel help page says downloading apps from unknown sources puts your phone and information at risk. Three things to do:

Uninstall any app you installed from the link.
Open Settings > Apps > Special app access > Install unknown apps. Turn off Allow from this source for your browser and messaging apps. This path is from Google’s Pixel help; Samsung and others may label it a little differently.
Check Play Protect. In the Play Store, tap your profile icon, then Play Protect, and act on any app it flags. Under its settings, keep Scan apps with Play Protect on. Google says it’s on by default, checks apps from other sources and may disable or remove harmful ones.

The FTC’s advice if a scammer got access to your phone is to update your security software, run a scan and delete anything it flags, then change your passwords and turn on two-factor. Change those passwords from a different device if you can, until you’re sure the phone is clean. On Android, Play Protect is built in and free, so you don’t need to buy an app to do this.

How to report the text

Reporting won’t fix your phone, but it helps carriers block the next wave. The FTC lists three ways:

Copy the message and forward it to 7726 (SPAM). This goes to your wireless provider.
Report it in the messaging app you use. Look for the option to report junk or spam in Apple Messages or Google Messages.
File a report at ReportFraud.ftc.gov.

The FBI’s Internet Crime Complaint Center also takes reports at ic3.gov. In its April 2024 warning about fake toll texts, it asked people to include the sender’s number and the website in the text. It had received over 2,000 complaints about those toll texts since early March that year.

They’re common. The FTC says people reported losing $470 million to scams that started with a text in 2024, five times the 2020 figure. Fake package-delivery texts were the most reported type, and fake unpaid-toll texts were among the frequent ones.

If you’re not sure whether a text was real, don’t use its link or number. The FTC says to contact the company using a phone number or website you know is real.

What to do next

Your 10-minute checklist, based on the FTC and Apple guidance above:

Minutes 0–2: Close the page. Update iOS (Settings > General > Software Update) or Android and Chrome.
Minutes 2–5: If you typed a card or bank login, call the number on the back of your card or your bank’s official number.
Minutes 5–8: Change any password you entered, plus reused ones, and turn on two-factor.
Minutes 8–10: Remove any profile (iPhone) or app (Android) the link installed, and check Play Protect on Android.
After that: Forward the text to 7726, report it at ReportFraud.ftc.gov, and go to IdentityTheft.gov if you gave out your Social Security number.

If your phone acts strangely afterward, don’t trust viral dial codes as a test. Here’s whether dialing *#21# tells you if your phone is hacked.

What happens if you click a link in a scam text?