What to do if you clicked a link in a scam text

Updated October 23, 2026

What you need to do depends on what happened after you tapped. If you only opened the page and typed nothing, close it, report the text, and delete it. If you entered a password, card number, code, or personal details, act now using the steps below, starting with the most sensitive thing you shared.

If you only opened the page

Close the tab and don't type anything into it. If the page offered a download or asked you to install a profile or app, don't. Then report the text and delete it (see "Report the text" below). Keeping your iPhone updated in Settings > General > Software Update gives you Apple's latest security fixes.

If you think something did get installed, the FTC says to update your security software, run a scan, and delete anything it flags. On iPhone, that mostly means deleting any app or profile you don't recognize.

If you entered a password

Change that password right away, on the real website or app (type the address yourself).
Change it anywhere else you used the same password.
Turn on two-factor authentication.
Sign out of all other devices, and check that the recovery email and phone number on the account are yours. The FTC also suggests checking for email forwarding rules you didn't set up.

For an Apple Account, change the password immediately and make sure two-factor authentication is on. Apple says it never asks for your password or verification codes to help you.

If you entered card or bank details

Call your bank or card company using the number on the back of your card. Ask them to block the card, send a new one, and dispute any charges you don't recognize. Federal law limits what you owe for unauthorized card charges, so report them quickly.

If you paid

Contact whoever handled the payment as soon as possible and ask them to reverse it, as the FTC recommends:

Credit or debit card: your card company.
Bank transfer or Zelle: your bank.
Payment app (Venmo, Cash App, PayPal): the app.
Gift cards: the company that issued the card. Keep the card and the receipt.
Crypto: the exchange or ATM company you used. Crypto is harder to get back.

If you gave your Social Security number or date of birth

Go to IdentityTheft.gov. If your information has been used, report it there and follow the recovery plan it gives you. If you're not sure, use IdentityTheft.gov's steps for exposed information. Consider a credit freeze with Equifax, Experian, and TransUnion: it's free, doesn't hurt your credit score, and makes it much harder for someone to open new accounts in your name until you lift it.

If you shared a verification code

Treat the account as compromised. Change the password, sign out other devices, and contact the company. Full steps: what to do if you shared a verification code.

Report the text

Forward it to 7726 (SPAM) so your carrier can block the sender, and use Report Spam (or Report Junk) under the message if you see it.
Report it to the FTC at ReportFraud.ftc.gov.
If you lost money, also file at ic3.gov with the FBI.

Step-by-step: how to report spam texts on iPhone.

Questions

Can just opening a scam link hurt my iPhone?

For most people, the bigger risk is what you type into the page, not opening it. Close the page, don't download anything it offers, and keep your iPhone updated in Settings > General > Software Update. If anything was installed, delete it.

Should I reply STOP to the scam text?

No. Replying tells the sender your number is active. Report the text and delete it instead.

Can I get my money back?

Sometimes. Contact whoever handled the payment right away (your bank, card company, or payment app) and ask them to reverse it. The faster you act, the better the chance.

Sources

Facts checked October 23, 2026.