I entered my details on a fake website — what to do now
If you’ve just typed your details into a site you now realise was fake, the most useful thing you can do is act quickly and in the right order. The faster you move, the less a scammer can do with what they got. Work through whichever of these matches what you entered.
If you entered a password
- Change that password straight away — on the real site, reached by typing the address yourself, not through any link you were sent.
- Change it anywhere else you used the same one. This is the part that matters most, and it’s exactly why reusing passwords is risky: one leaked password unlocks every account that shares it. A password manager fixes this for good.
- Turn on two-factor authentication so a stolen password alone isn’t enough to get in.
- Start with your email if that’s the password you gave away — it’s the master key to everything else. See what to do if your email has been hacked.
If you entered card or bank details
- Call your bank now, using the number on the back of your card. Ask them to stop the card and watch the account.
- Check your statements and report anything you don’t recognise.
- Be ready for a follow-up call. Scammers often ring soon after, posing as your bank’s fraud team to “help” — that’s a second scam. See is that call from your bank real. Never move money to a “safe account.”
If you entered personal information
If it was your name, address or date of birth rather than a login or card, the immediate risk is lower, but stay alert. Criminals use those details to make future scam messages more convincing, so treat unexpected contact with extra suspicion for a while.
Then tighten the rest
- Check whether that password has turned up in a known breach with our breach checker, and read how to check if your password has leaked.
- Report the scam: forward scam texts to 7726, and report fraud through how to report a scam in the UK.
Watch for the second wave. Once you've entered details, scammers often move fast — a call or message claiming to be your bank, or the "website's security team," trying to finish what they started. Don't trust incoming contact about it. You make the call, on a number you found yourself.
The bottom line
You’re not foolish for this — these sites are built to catch careful people having a busy day. What decides how much it costs you is how quickly you act. Lock the password, call the bank, and watch for the follow-up.
For the full, calm walkthrough, see what to do if you’ve been scammed. And to sharpen your eye for next time, here’s how to check if a website is legit. More in our scams and fraud section.