It was 7:15 in the morning, and I hadn't finished my first cup of coffee. A text popped up: "USPS: Your package is held due to an incomplete address. Update here within 24 hours." I was expecting a birthday present for our granddaughter, so I tapped the link without thinking twice.
A page came up that looked just like the Post Office website. It wanted my address, and then a $1.49 "redelivery fee" with my card number. That's when my coffee finally kicked in. The Post Office doesn't text me asking for a card number. I closed the page and sat there with my heart racing. What did I just do?
Oh, I felt so silly. But here's what I learned that morning, and I want you to have it before you need it.
Is clicking a suspicious link dangerous?
Take a breath. In most cases, the click itself does very little, especially on a phone that's up to date. What scammers really want is what happens after the click: you typing a password into a fake page, entering a card number, or installing something they tell you to download.
The FTC's guide on recognizing and avoiding phishing scams explains how these fake messages copy real companies to trick people into sharing information. If you closed the page without typing anything, you're very likely fine. If you did type something, don't panic. There are clear steps.
What should I do right after clicking a suspicious link?
In plain words, five steps. First, close the page and don't tap anything else on it. Second, type nothing, no password and no card number. Third, check your phone: on an iPhone, make sure iOS is updated, and on an Android phone, open the Play Store, tap your profile picture, then Play Protect, and run a scan. Fourth, if you typed a password, change it right away, along with anywhere else you use that same password. Fifth, glance at your bank and card statements every day for two weeks.
Most people who closed the page quickly only need the first three steps.
What if I typed in my card number or password?
Call the number on the back of your card and tell them what happened. They can block the card and send a new one, and they deal with this every day. If you typed a password, change it from your own phone or computer, not from any link. Turn on sign-in alerts if the account offers them, and consider a passkey, which scammers can't steal with a fake page.
If the scammer may have your personal details, a free credit freeze is a smart extra step. Report the scam at ReportFraud.ftc.gov too.
How can I tell a fake link before I tap it?
Put simply, press and hold a link instead of tapping it, and your phone shows a preview of the web address. A real one looks like the company's plain name, like usps.com. A fake one adds extra words or odd endings, like usps-redelivery-help.top. When you're not sure, skip the link completely and open the company's app or type the website yourself.
What should I do with the scam text?
Report it, then delete it. You can forward scam texts to 7726, which spells "SPAM" on your keypad, and your phone carrier uses those reports to block more of them. Then delete the message so you can't tap it again by accident.
And watch out for the second half of the scam: a pop-up or phone call a few days later saying your phone is "infected" and offering to fix it. Real security warnings never ask you to call a number. Our post on fake renewal emails covers that trick.
What I did after my coffee kicked in
I closed the page, updated my phone, and forwarded the text to 7726. I hadn't typed my card number, so that was the end of it. Then I told Bob and our book club, because scammers count on us keeping quiet. Two of the ladies had gotten the same text that week. The birthday present, by the way, arrived right on time.
Take good care of yourself, and take even better care of each other.
Have you ever clicked a link and then worried? Tell me in the comments what happened. You're not the only one.
