The steps depend on what happened after the tap. Close the page, then work through the list below from the top: it starts with the steps that protect money and accounts, and ends with reporting the message so fewer people receive it.
The short answer. Close the page, then act on what happened: change a password you typed, call your bank about card details, scan for anything installed, report lost money, and forward the text to 7726.
Last reviewed 4 October 2026. Based on advice from the United Kingdom National Cyber Security Centre (NCSC) and the United States Federal Trade Commission.
First, close the page
Close the page and type nothing more into it. Then find the line below that matches what happened. If more than one matches, do each one.
If you typed a password
Change that password now, using the app or a website address you type yourself, not the link in the text. Change it on any other account that uses the same password. The NCSC also suggests turning on two-step sign-in, or a passkey where the account offers one.
If you gave card or bank details
Call your bank straight away on the number printed on the back of your card. Tell them what you entered and when. The NCSC lists this as the first step for bank details.
If something downloaded or installed
Update your security software, run a full scan, and remove anything it flags. Both the NCSC and the Federal Trade Commission give this step.
If you gave other personal details
In the United States, IdentityTheft.gov, run by the Federal Trade Commission, gives steps based on which details you gave, such as a Social Security number or a date of birth. Elsewhere, see official help, country by country.
If it was a work phone
Tell your information technology team or the person who looks after work devices. A question asked early is part of the job.
If money has left your account
- England, Wales and Northern Ireland: report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040.
- Scotland: call Police Scotland on 101.
- United States: report it at ReportFraud.ftc.gov.
- Other countries: official help, country by country.
Tell your bank as well, because the bank is the one that can try to stop or recover a payment.
Report the text
In the United Kingdom and the United States, forward the text to 7726. In the United Kingdom this is free, and the phone company can block the sender. Your messaging app may also have a Report junk option. Reporting helps protect the next person who receives the same message.
Next time a text asks you to act
Contact the company through a number or website you already know, never the one in the message. Before You Pay asks six short questions about any payment request, on your own phone. If you doubt it, UtilForge it.
Sources
- NCSC, if you have shared sensitive information
- NCSC, report a suspicious text message
- The Federal Trade Commission, how to recognise and avoid phishing (updated October 2024)
- The Federal Trade Commission, how to recognise and report spam texts (updated July 2022)
Watch: the short video
Related guides
Free
Check the next
one first.
Before You Pay runs on your own phone or computer. What you type stays on your phone or computer.