I clicked. What now?
Close the page before you type anything. Then work through these in order. If you have not clicked yet, paste the address into Electryo as text instead of opening it.
Six steps, most urgent first.
Step 01
Do not enter a password on that page
Close it. A password manager refuses to fill a lookalike domain, and so should you. Do not type a password, a card number, or a code from a text message into a page you reached from a surprise link.
Step 02
If you did enter a password, change it
Open the real site yourself by typing the address or using a bookmark you already trust. Change the password there, and sign out of other sessions. If you reuse that password anywhere else, change it there too.
Step 03
Check sign-in methods
Remove devices and apps you do not recognise. Turn on a passkey or a hardware key so a stolen password is not enough on its own.
Step 04
If it asked for a payment, tell the bank
Call the number on the back of the card, not a number from the message. Say you may have given card details or authorised a payment after a suspicious link.
Step 05
If it was email, look at the mailbox you own
Forwarding rules and inbox filters are how some takeovers stay quiet. Check them on the real provider site, not through the message. You can also check SPF and DMARC on a domain you publish.
Step 06
If it was a calendar invite, stop unknown meetings
In Google Calendar, set Add invitations to my calendar to only invitations from known senders. Delete the event if you did not expect it. Do not join a meeting link from the invite.
Close the gaps it came through.
Your domain
Check SPF and DMARC on a domain you own
See whether other people can send mail that looks like yours.
Check your domainThe method
How Electryo checks a link without opening it
Offline checks, a budgeted investigation, then a verdict computed from evidence.
How checks work