What to do if you accidentally click on a suspicious link

In Australia, the ACCC's Scamwatch service has tracked a steady rise in malicious link incidents, with thousands of reports filed from Sydney, Melbourne, and regional Queensland every quarter. A single misstep on a phone or laptop can feel trivial until the browser starts behaving oddly or an account password suddenly fails.

The moment you realise you have tapped on something you should not have, the clock starts ticking. Modern phishing campaigns are built to harvest credentials or drop malicious payloads within seconds, and Australian banks including CBA and ANZ have publicly warned that they will never send links asking customers to verify accounts through email or text.

This guide walks through the practical steps to take in the first hour, the first day, and the week after a suspicious click. It also explains how to reduce the chance of a repeat incident, whether you are working from a home office in Brisbane or using public Wi-Fi at a cafe in Perth.

Quick, deliberate action matters far more than any single technical trick. Most successful compromises happen because the person who clicked did not know what to do next, rather than because the attack itself was sophisticated.

Disconnect and isolate the device

The first move is to sever the connection between the device and any network it is using. Pulling the ethernet cable, turning off Wi-Fi, or enabling airplane mode on a phone stops any background software from talking to its controller. This is the same approach that IT teams in Australian government departments use when a workstation is suspected of being compromised.

Do not power the device off just yet. Keeping it running allows you to monitor active processes, check recently installed applications, and observe any unusual network activity once you reconnect for a brief, controlled scan. A complete shutdown can sometimes trigger ransomware to activate, though this risk is lower on consumer machines than on corporate servers.

If the click happened on a work device, contact your IT department immediately, even outside business hours. Australian businesses covered by the Notifiable Data Breaches scheme have strict reporting timelines, and a prompt call could be the difference between a contained incident and a formal disclosure to the Office of the Australian Information Commissioner.

Understand what kind of link you clicked

Not every suspicious link leads to the same outcome. Some pages exist purely to harvest whatever you type into login forms, while others try to convince you to install a "browser update" or "media player" that is actually malware. A useful breakdown of similar mechanics is the what really happens when you click I agree on a privacy policy review, which explains how accepting site terms can quietly authorise tracking scripts.

If the page asked for a password, treat that password as compromised regardless of whether you submitted it. If it triggered a file download, the file is the threat, not the page itself. If it simply loaded and closed, you may still be dealing with a drive-by download that exploited a browser vulnerability, which is why scanning matters even when nothing visible happened.

Take a screenshot if anything is still on screen, then close the browser tab. Avoid clicking "unsubscribe" or "remove me from this list" buttons inside the page, as these often confirm that your email address is live and actively monitored by scammers.

Recognise the warning signs of a compromise

The next few hours and days are when the most telling symptoms usually appear. A slow browser, unfamiliar toolbars, or a laptop fan that suddenly runs at full speed are all worth investigating, even if they have a perfectly innocent explanation.

Common red flags to watch for after a suspicious click:

If any of these appear, treat the device as actively compromised and move directly to a full scan and credential reset.

Type of suspicious link Typical goal Immediate sign Priority response
Phishing login page Steal usernames and passwords Fake login form for a known brand Change that password everywhere it is reused
Fake software update Install malware or spyware Browser pop-up urging an urgent update Run a full antivirus scan, then remove unknown apps
Drive-by download Exploit a browser vulnerability Page opens and closes on its own Update the browser and scan the device
Scam survey or giveaway Harvest personal data and payment details Offer of a gift card or prize in exchange for details Stop typing, close the tab, and monitor financial statements

Scan the device and remove anything unwanted

Run a full system scan using reputable antivirus software. Built-in tools like Windows Defender or Apple's XProtect are a solid starting point, but a second-opinion scanner such as Malwarebytes can catch items the first pass missed. Make sure the scanner's definitions are up to date before running it, since older signature databases cannot detect newer Australian-targeting scams.

Beyond antivirus, check the list of installed programs and browser extensions manually. Anything you do not recognise or no longer use should be removed. Pay particular attention to remote-access tools like AnyDesk or TeamViewer if you did not install them yourself, as these are frequently bundled with scam payloads.

On a phone, the equivalent step is to review the apps installed in the last 24 hours through the App Store or Google Play purchase history. Some malicious apps hide inside seemingly innocent utilities, such as calculator clones or wallpaper apps, so uninstall anything that arrived around the same time as the click.

Secure accounts and harden your network

Change passwords starting with the most sensitive accounts: email, banking, and any account holding payment details. Australian institutions like Westpac and NAB now offer in-app security menus that let you force a logout from all sessions, which is a useful feature after a suspected compromise.

For longer-term protection, look at how your home network is configured. A segmented network with the guest feature enabled keeps smart TVs and IoT devices away from laptops and phones, and a straightforward walkthrough of home network setup covers the essentials without requiring a background in networking.

Enable two-factor authentication on every service that supports it, prioritising app-based codes or hardware keys over SMS. SIM-swapping remains a real threat in Australia, and criminals have used intercepted SMS codes to drain accounts within minutes.

A few habits that make the next suspicious link far less dangerous:

Report the incident to Scamwatch and forward scam texts to 0429 999 888, the ACCC's dedicated reporting number. For incidents involving financial loss or identity theft, the Australian Cyber Security Centre's ReportCyber portal connects you with the relevant law enforcement and may assist with recovery.

A suspicious click does not have to turn into a disaster. The combination of fast disconnection, thorough scanning, and prompt password resets handles the vast majority of incidents, and the small habit changes made afterwards usually make the next attempt fail before it even starts.