Take a breath. These emails are built by professionals to fool careful people — clicking is not the disaster; doing nothing next is. Find your situation below and do the steps in order. Most take under five minutes.
The most common case — and usually the easiest.
Treat the password as stolen — speed matters here.
Attachments can carry malware — let's check the computer.
Money and identity move fast — the phone beats the computer now.
This is the "tech support" con. Act physically, not politely.
Usually clicking a link alone causes little harm — the danger comes next, if you type a password, download and open a file, or call a number the page shows. Close the tab, don't press anything on the page, and if a virus warning with a phone number appears, treat it as fake and never call it. Watch the account closely for the next few days.
Treat the password as stolen and act fast. From a different device, change that password immediately, and change it anywhere else you reused it, starting with your email — whoever controls your email can reset everything else. Turn on two-step verification during the reset, and watch for break-in attempts on the mailbox.
Call your bank or card company right now using the number on the back of the card, never one from the email, and ask for the fraud department — they can block or reverse most things if you are quick. If money was sent by wire or gift card, ask about a recall and report at IC3.gov. For Social Security or Medicare numbers, place a free credit freeze with all three bureaus to stop new accounts in your name.
Yes. If you let someone connect to your computer or you are on the phone with a supposed tech-support agent, hang up and turn the computer completely off to sever the connection, and do not pay anything they asked for. Remote-access tools can leave doors open, so get help closing them before turning the machine back on.