Playbooks / Phished account

I clicked a phishing link

You entered a password on a fake page, opened a malicious attachment, or approved a login you did not start.

Use this if you typed credentials or an OTP into a page you now doubt, or an account shows logins you do not recognise.

First ten minutes

From a different device if you can, change the password of the affected account, then of any other account that used the same password.
Sign out all other sessions (most accounts have “sign out everywhere”), and remove unknown devices and app passwords.
If an OTP or banking detail was shared, call your bank and block the card or net banking now. In India, call 1930 immediately: money moved in the first hours can often be frozen.
If you opened an attachment or installed something, disconnect the device from the network and run a full malware scan.

In e-mail, look for new forwarding rules, filters that hide mail, and a changed recovery address or phone number. Attackers set these to keep access.
Check sent mail and contacts: they may have written to your contacts from your account. Warn them.
Review recent sign-ins, connected apps and bank or UPI transactions.
Use the Link inspector and Email header analyser on the original message to understand how it was dressed up.

Turn on two-factor authentication using an authenticator app or a hardware key rather than SMS where possible.
Move to a password manager so every account has a unique password.
Report the message as phishing in your mail app, and the site to the impersonated company.

India: report financial fraud at cybercrime.gov.in or call 1930. Do it within hours; the earlier, the better the chance of recovery.

General guidance, not legal or forensic advice. For a serious incident, involve a professional incident-response firm.