I clicked a weird link. Now what?

Dan's phone buzzes. A text: his parcel is delayed, tap here to sort it out. He's actually waiting for a parcel. So before his brain catches up with his thumb, he taps.

A page opens. And then the thought arrives: uh oh.

Breathe. Did you type anything?

That's the first thing Liz asks, and it's the question that matters most.

Dan hadn't. Not yet.

“On an up-to-date phone,” says Liz, “you're probably fine.”

That might sound surprising. We're often told never, ever to click a link, as if the click itself were the disaster. But look at what these fake parcel texts are actually built to do.

The link opens a door. The form is the trap.

Dan's page looked like a delivery company's website. It said there was a tiny fee to pay to get his parcel moving again. And underneath, neat little boxes for his card number, expiry date and security code.

That form is the whole point. The fee is bait. It's small enough that you don't think twice, and the scammers aren't after the fee. They're after your card details.

This kind of scam is so common that the US Postal Inspection Service has a page about it. It says the US Postal Service won't text you unless you first asked for updates with a tracking number, and that its texts won't contain a link at all. The FTC warns about the same trick: a delivery notification that looks real but isn't.

The general name for this is phishing: messages that pretend to be from someone you trust, to get you to hand over information. When it arrives by text, it's sometimes called smishing (SMS plus phishing).

Why “up to date” matters

So can a click alone ever hurt you? Rarely, but it's possible, and that's why Liz said “probably”.

Phones, like all software, sometimes have flaws. Apple's list of security updates regularly includes fixes for flaws where a booby-trapped web page could make an out-of-date device run harmful instructions without asking you. Some of those flaws were being used by attackers before they were fixed. Android has its own security bulletins, with fixes for Android phones, for the same reason.

Updates close those doors. That's why the advice comes with a condition: on an up-to-date phone, a tap with nothing typed is rarely a problem.

What now?

Liz's steps are short, and the order matters:

1. Close the page. Type nothing. Nothing typed, nothing taken.
2. Report the text. In the US, the UK and Canada, forward it to 7726, which spells SPAM on a phone keypad. It's free. Elsewhere, check with your phone company or your country's scam reporting service; in Australia, for example, the number can be different.
3. If you typed your card details, call your bank right away. Use the number on the back of your card, not one from the text or the page.
4. If you typed a password, change it, and change it anywhere else you used the same one.

And Dan's real parcel? He checked it the safe way: in the delivery company's own app. It was arriving today.

What the video left out

Belt and braces. Some official advice goes further than the video did. The US Postal Inspection Service suggests telling your bank even if you didn't submit anything, and the FTC suggests updating your security software and running a scan if you clicked. Neither is a bad idea if you want extra peace of mind.

Spotting the fake. This video starts after the tap, so it doesn't cover how to spot a fake text. One habit covers most cases anyway: if a message says there's a problem, don't use its link. Go to the company's app or website yourself.

So the click is rarely the disaster. Typing your card is.

What you can do

• Tapped but typed nothing? Close the page, and don't go back to it.
• Forward the text to 7726 (US, UK and Canada), then delete it.
• Typed card details? Call your bank on the number on the back of your card, right away.
• Typed a password? Change it, and change it everywhere else you used it.
• Keep your phone updated. It's what makes a tap alone so rarely a problem.
• Check deliveries, bills and accounts in the company's own app or website, never through a link in a text.