First, don't panic.
Clicking a suspicious link does not automatically mean your phone has been hacked or your money has been stolen. What matters is what happened after you clicked it.
The risk becomes higher if you:
Entered personal information
Shared a password or OTP
Downloaded a file
Installed an app
Approved a payment or banking request
What you should do next depends on what you did after opening the link.
If You Only Opened The Page
If you clicked the link but did not enter any information, download anything or approve a payment, the risk may be lower.
Do not:
Tap anything else on the page
Allow notifications or other permissions
Download files
Call phone numbers displayed on the page
Enter your personal, banking or login information
Take a screenshot of the original scam message for evidence. Then close the page, report the message or account and delete it.
You should also keep an eye out for unusual messages, login alerts or transactions afterwards.
If You Entered Your Password
Change the password immediately using the official app or website not through the scam link.
Then:
Sign out of other active sessions
Enable two-factor authentication
Check for unfamiliar devices or login activity
Change the password on other accounts where you reused it
Start with your email account, especially if it is used to reset passwords for your other accounts. If scammers gain access to your email, they may be able to take over other accounts too.
If You Shared Your Banking Details
Contact your bank immediately using the phone number on the banks official website or the back of your card.
Ask the bank to:
Secure or temporarily block your account if necessary
Block any affected cards
Check for suspicious or unauthorised transactions
Advise whether your banking login details need to be reset
Do not wait for a transaction to appear before contacting your bank if you have already shared sensitive banking information.
If You Shared An OTP
Contact your bank immediately.
An OTP may be used by scammers to approve a login, card payment or other transaction, depending on what the OTP was issued for.
Also, never approve a Secure2u or banking-app request that you did not initiate yourself.
If you receive an unexpected approval request, treat it as a warning sign and contact your bank through an official channel.
If Something Was Downloaded
If you accidentally downloaded a suspicious file, do not open it.
Delete it if it is safe to do so, and run a security scan on your device.
If you installed an unknown or suspicious app, take additional precautions:
Disconnect the device from the internet
Remove the suspicious app
Check for unfamiliar apps and permissions
Update your operating system
Run a security scan
Avoid logging into sensitive accounts such as your banking or email accounts on the affected device until you are confident that it is safe.
If You Approved A Payment Or Money Was Taken
Act immediately.
Contact your bank using its official emergency or scam-reporting channel. In Malaysia, you can also contact the National Scam Response Centre (NSRC) at 997.
The sooner you report a suspected scam, the better the chance of limiting further losses or taking action on the transaction.
You should also lodge a police report and keep screenshots, transaction records, phone numbers, messages and other evidence related to the scam.
Even if more than 24 hours have passed, report the incident anyway. Do not assume it is too late to seek help.
Remember This Simple Rule
Only clicked? Close the page and monitor your accounts.
Entered a password? Change it and secure the account.
Shared banking details? Contact your bank immediately.
Installed an unknown app? Isolate the device and check it for suspicious activity.
Approved a payment or lost money? Contact your bank and call 997 immediately.
Most importantly, don't panic and don't interact with the scammer further. The faster you stop, secure your accounts and contact the right official channels, the better.
