My mother clicked a phishing link — what should we do now?

Question

My mother clicked a link in a fake bank text and entered her password before realizing it was fake. What should we do in the next hour, and what should we watch for afterwards?

admin · Accepted Answer

Immediate containment and credential reset are the top priorities to protect your mother’s financial and digital identity from compromised access.

Change credentials across all platforms: Reset the password for the compromised bank account immediately, then update any other accounts using the same credentials. Enable multi-factor authentication (MFA) on every financial and email account, preferring app-based codes over text messages since SMS can be intercepted.
Monitor for fraudulent activity: Review recent bank and credit card statements for small, unauthorized test charges. The Federal Trade Commission recommends filing a report at IdentityTheft.gov to create a formal record of the incident with federal agencies.
Guard against account hijacking: Phishers often target the linked email address to intercept password reset links. Check the email account for suspicious logins, and update the email password and security questions if the same password was reused.
Place a fraud alert: Contact one of the major credit bureaus, such as Experian or Equifax, to place a one-year fraud alert on her credit file. This requires companies to verify her identity before issuing new credit.
Educate on future prevention: Teach her that legitimate banks will never ask for passwords or full account numbers via text message. Encourage her to manually type the bank’s verified URL into a browser to log in, rather than using provided links.

Stay calm and act quickly; most breaches are manageable if caught within the first hour.

My mother clicked a phishing link — what should we do now?

Related Questions