Scam help

I clicked a scam link on Facebook or Messenger

Scam links spread on Facebook and Messenger through messages from hacked friends, fake giveaways, and fake “your page will be disabled” warnings. If you tapped one, here’s what to do.

How to tell it was a scam

  • A friend sends “Is this you?” or “Look who died” with a link, out of character.
  • A warning that your page breaks the rules and will be deleted unless you “appeal” through a link.
  • A Facebook sign-in page on a different domain.
  • Giveaways from pages that copied a real brand’s name and logo.

See where the link really went

Copy the link from the message (long-press it, then Copy) and paste it here. We open it from our server, not your device.

I only opened the page

On an up-to-date phone or computer, just opening a scam page rarely does damage by itself. The danger is what the page asks you to do next.

  1. 1Close the tab and don’t go back to it.
  2. 2Delete the message, and report it first if you can (see below).
  3. 3Install any pending system and browser updates.
  4. 4If the page asked to “Allow notifications” and you tapped Allow, remove it: on Android open Chrome › Settings › Notifications, on iPhone go to Settings › Notifications, on a computer check your browser’s site settings.

I typed a password or sign-in details

Assume the scammer has that password and act now.

  1. 1Change the password on the real site or app, and anywhere else you use the same password.
  2. 2Turn on two-step verification for that account.
  3. 3Sign out other sessions (look for “Where you’re logged in” or “Devices” in the account’s security settings).
  4. 4Check the account’s recovery email and phone number haven’t been changed.

I entered card or bank details

Call your bank or card issuer straight away, using the number on the back of your card.

  1. 1Ask them to block the card and send a new one.
  2. 2Go through recent transactions with them and dispute any you don’t recognise.
  3. 3Watch for follow-up calls or texts “from your bank”: scammers often call next, pretending to help.

I gave personal details (address, date of birth, ID or Social Security number)

This can be used for identity theft, so lock things down.

  1. 1In the US, go to IdentityTheft.gov for a recovery plan.
  2. 2Consider a free credit freeze with Equifax, Experian and TransUnion.
  3. 3Be suspicious of any call, text or email that knows those details.

I gave someone a one-time code

A code sent to your phone lets someone sign in as you or approve a payment. Treat it like a password.

  1. 1Change the account’s password and sign out all other sessions.
  2. 2If it was a bank or payment code, call your bank now.
  3. 3Nobody genuine will ever ask you to read a code back to them.

I downloaded or installed something

This is the most serious case, because the app may keep running.

  1. 1Delete the app or file. On Android, check Settings › Apps for anything new or unfamiliar.
  2. 2On iPhone, check Settings › General › VPN & Device Management and remove any profile you don’t recognise.
  3. 3Run your device’s built-in protection: Google Play Protect on Android, or your security app on a computer.
  4. 4If you installed a remote-access app because someone told you to, disconnect from the internet and contact your bank.

Report it

Secure your account

If you entered your password, change it and check “Where you’re logged in” under Accounts Center › Password and security. If you can’t get in, go to facebook.com/hacked.

Report the message

Use “Report” on the post or message, and warn the friend whose account sent it.

Forward the text to 7726 (SPAM)

This reports the sender to your mobile carrier in the US and many other countries.

Report it to the FTC

At ReportFraud.ftc.gov (US).

Block the sender

And delete the message after reporting it.

Common questions

Can my phone be hacked just by tapping a scam link?

On an up-to-date iPhone or Android phone, simply opening a scam page rarely does harm by itself. The damage usually comes from what you do next: entering a password, card details or a code, allowing notifications, or installing something.

Should I reset my phone after clicking a scam link?

Usually not. If you only opened the page, closing it and updating your phone is enough. If you installed something, remove it first; a reset is a last resort.

How do I check where a scam link went?

Paste it into the checker on this page. We open it from our server, so you can see every redirect and the final page without opening it again on your device.

Help for specific scams

Any scam link USPS text Unpaid toll text Amazon scam message Check a QR code