What to Do If You Clicked a Scam Text Link in Australia

Clicking a scam text link is unsettling, especially when the message looked real at first glance. Take a breath. The click on its own is rarely the problem; what matters is what happened next, and there is a calm, clear set of steps to work through. This guide lays them out in plain English for older Australians and their families. If you are still trying to decide whether a message is dodgy, read our guide on how to spot text message scams in Australia. You will find more advice like this in our main guide to staying safe online.

Step 1: Close the scam page

If the page is still open, close it, and don’t press any more buttons, type in any details, or ring a number shown on it. Scam pages love to shout that your phone is infected, your account is locked, or you must act this instant. That urgency is the trick. Whatever it says, do not follow the instructions on that page.

Step 2: Work out what happened

How serious this is depends entirely on what you did after the page opened. Find the situation below that matches.

If you only clicked the link

If you clicked but typed nothing in, you are most likely fine. Close the page, report the text and then delete it, run any phone update that is waiting, and keep half an eye out for more scam messages over the next while. This is far less serious than entering details or making a payment.

If you entered your name, address or date of birth

If you gave personal details, take a screenshot if the page is still open, jot down exactly what you entered, and report the scam. Then be a bit wary of follow-up messages by text, phone or email, because scammers use those details to make the next approach sound more convincing. If you are worried about identity theft, IDCARE can help, and we cover that below.

If you entered bank login details

If you typed in your internet banking username, password, access number, security answers or a verification code, contact your bank immediately, using the number on the back of your card or the bank’s official website. Tell them plainly that you entered your details into a scam website, follow their instructions, and change your banking password if they ask you to. Do not call any number from the scam message or page.

If you entered card details

If you entered a debit or credit card number, ring your bank or card provider straight away and ask whether the card should be blocked or replaced. Check your recent transactions, and keep checking over the next few days, since scammers sometimes run a small payment first just to see whether the card works.

If you entered a password

If you typed a password into the scam page, change it straight away, and change it anywhere else you have used the same one. Make the new password genuinely different, not a small tweak of the old one, and turn on two-step verification if the account offers it. Two-step verification means a second check before anyone can get in, usually a code sent to your phone, so a stolen password is not enough on its own.

If you entered an email password

Your email matters more than most people realise, because whoever controls it can reset the passwords for your other accounts. So if you entered your email password, change it immediately, then check the account’s recovery phone number and backup email, look for any mail-forwarding rules you did not set up, and glance through your sent folder for anything you did not send. Turn on two-step verification while you are there. If you are not comfortable poking around those settings, ask a family member or a computer support person to sit with you.

If you downloaded or installed an app

If the page talked you into installing an app, delete it and don’t open it again, then run a phone update. If the app asked for any financial information, contact your bank, and have a trusted person or phone support provider check the device. Some of these apps are built to quietly collect information or watch what you type, so it is worth being thorough.

Step 3: Contact your bank if money or banking details are involved

Ring your bank without delay if you entered bank login or card details or a verification code, made a payment, gave someone remote access to your phone or computer, saw money leave your account, or simply are not sure what you typed in. Use an official contact: the number on the back of your card, the bank’s own website or app, or a branch if that is easier for you. Never use a number from the scam.

You do not need a polished explanation. Something as simple as “I clicked a scam text link and may have entered my details, can you please check my account security?” is exactly right. It is always better to call early, even if you feel unsure or a bit silly. Banks deal with this every single day.

Step 4: Change affected passwords

Only ever change a password on the real website or app, never through the link in the text. If the scam pretended to be about your email, for instance, go straight to your email provider’s own website. Change the password for the account you entered, for any other account that shares that password, for your email if email details were involved, and for your bank if they tell you to. A good password just needs to be hard for someone else to guess, not hard for you to remember; a few unrelated words with a number or symbol added works well.

Step 5: Report the scam in Australia

Reporting is free and helps protect other people. There is no single number for everything in Australia, but the list is short:

• Forward the scam text to 7726, free of charge. Your phone company uses these reports to block the numbers behind so many scams.
• Report the scam to Scamwatch at scamwatch.gov.au. Scamwatch is run by the National Anti-Scam Centre, part of the ACCC. It is an online report, with no phone line, and it helps them warn others and have dodgy websites taken down.
• If an account was hacked or money was taken through online fraud, report it to ReportCyber at cyber.gov.au, which passes your report to police. If you would rather talk to someone, the Australian Cyber Security Hotline is open every hour of every day on 1300 292 371.
• If your personal details were taken, contact IDCARE on 1800 595 160 or at idcare.org. This is Australia’s free identity and cyber support service, and they can help you work out the risk and the steps to take.

Step 6: Keep a short record

If you can, jot down a few notes while it is fresh: the date and time, the number the text came from, what it said, the website link if you can see it, what details you entered, whether any money was paid, and who you contacted afterwards. It is not about building a case; it just helps your bank, Scamwatch or a support service understand what they are dealing with.

Step 7: Watch for follow-up scams

After someone clicks a scam link or enters details, more attempts often follow, by text, phone call, email, WhatsApp or Messenger, or a fake support call. Be especially wary of anyone who gets in touch offering to recover your money for a fee, because that is usually a second scam riding on the back of the first. If money has actually gone, speak to your bank before anyone else.

What not to do after clicking a scam text link

A few things to steer clear of:

• Don’t keep using the scam website
• Don’t call phone numbers from the scam page
• Don’t reply to the scam text
• Don’t send more money
• Don’t install apps the scammer suggests
• Don’t give anyone remote access to your phone or computer
• Don’t feel embarrassed about asking for help

These messages are built to catch people when they are busy, tired or worried. Falling for one says nothing about you.

How family members can help an older parent

If a parent or older relative clicked a scam link, the most useful thing you can do is stay calm. The goal is to help them act quickly, not to make them feel foolish. Walk through what happened step by step, work out whether they entered bank details, card details or passwords, and help them contact their bank, change passwords, report the text and check the phone for any apps that should not be there. Then agree a simple rule together for next time.

A good one is: “If a text asks for money, bank details, passwords or urgent action, we check it another way first.” That gives your parent explicit permission to pause and ring someone they trust, which is exactly what these scams are designed to stop them doing.

When to get extra help

Reach out for help if money has left an account, if bank details, a password or a verification code were entered, if an app was installed, if the phone is behaving strangely, or simply if the person feels worried. The first ports of call are the bank, Scamwatch at scamwatch.gov.au, reporting the text to 7726, IDCARE on 1800 595 160 if personal details were taken, and a trusted family member or local computer support person. None of it needs to be faced alone.