Clicked a Fake Lottery Link? What to Do Next
Stop interacting with the page and work out what you shared. Clicking a fake lottery link, entering a password and sending money require different responses. You do not need to finish the claim form or negotiate with the sender before protecting your accounts.
Write a quick incident note
Record the approximate time, device used, message source and actions taken. Note whether you entered a password, shared a code, supplied card details, downloaded software or approved a payment. Describe what happened rather than guessing what the attacker can do.
For example: “Opened the page on my phone at 18:10; entered an email password; no card details entered.” This fictional note is more useful for support than “I clicked something bad”. Do not write the password itself into your notes.
If you only opened the page
Close it and do not follow further instructions. The NCSC’s incident guidance recommends a full antivirus scan when you followed a suspicious link on a computer or installed software. Use trusted security tools, not a “clean-up” download offered by the suspicious page. For a work device, contact your IT team.
If you entered a password
Go to the real service through its normal app or independently known address. Change the exposed password and any reused copies. If you cannot sign in, use the provider’s account-recovery process.
The NCSC account-recovery guide also recommends checking email forwarding rules, signing out existing sessions and enabling two-step verification. Follow the service’s own instructions; menu names differ between providers.
Do not send a new authentication code back to the original messenger. Keep the recovery process inside the genuine service’s channels.
If you supplied financial details or sent money
Contact your bank, card issuer or payment provider promptly using its official app or a known number. Explain exactly what was exposed and ask what protective steps and transaction-review options apply. Recovery is not guaranteed.
The FTC’s response guide gives separate steps for different payment methods. Its legal and reporting details are US-specific; readers elsewhere should use their own provider and local fraud-reporting authority.
Keep evidence without spreading the link
Keep messages, transaction references and screenshots where possible. Record the suspicious address as text for a report rather than posting a clickable link publicly. Remove account numbers and personal documents from anything you share with friends or a public forum.
Make a simple action log: who you contacted, when, the reference given and the next step they requested. This helps you distinguish a genuine follow-up from a new unsolicited caller claiming to know about the incident.
Frequently asked questions
Does a normal-looking account mean everything is safe?
It is useful information, but not a reason to leave an exposed password unchanged. Check through the provider’s security settings and continue the relevant recovery steps.
Can someone recover everything for a fee?
Be cautious of new offers after the incident. Read our guide to recovery-fee scams before responding.
Should I blame myself for clicking?
Focus on the next practical action. If you feel overwhelmed, ask a trusted person to help organise the steps without handing over passwords.
For prevention, see QR code prize checks and WhatsApp prize-message checks.
Educational consumer-safety information. Lottery participation is gambling, not a reliable income source. Do not chase losses; seek local support if gambling is causing harm. Reporting and account-recovery procedures vary by country and provider.