What to Do If You Typed Your Password Into a Fake Website

You clicked a link, landed on a page that looked like your bank or Amazon or Microsoft, typed in your username and password — and only afterward did something feel off. Maybe the page looked slightly wrong, or a friend mentioned a similar scam. If you typed your password into a fake website, you're not alone, and there's a clear, calm way to handle it.

This kind of fake page is called a phishing site: a copy of a real login page built only to steal what you type into it. The moment you find out you've been on one, a few quick steps can keep the damage small.

Here's exactly what to do, in order.

1. Change that password right now

Go straight to the real website — type the address yourself or use a bookmark you already trust, not a link from an email or text. Sign in and change your password immediately.

Pick a new password you haven't used anywhere else. If that account offers two-factor authentication (a second step, like a code texted to your phone, in addition to your password), turn it on. It means a scammer who has your password still can't get in without that second code.

2. Change that same password everywhere else you used it

Here's the real risk: if you used that same password on other accounts — email, other shopping sites, banking — a scammer who steals it from one fake site can try it everywhere else. This is called credential stuffing, and it's one of the most common ways accounts get taken over.

Make a short list of any accounts sharing that password and change each one, starting with your email. Your email account matters most, because it's usually how you'd reset every other password if something went wrong.

If keeping track of separate passwords feels overwhelming, a password manager can remember them for you so you only have to remember one — a password manager means software that stores your passwords safely and fills them in for you, so you don't have to memorize or write down a long list. If you'd like a person to help you set one up, Porchswing can walk you through it in your home or remotely.

3. Check your email and bank accounts for anything unfamiliar

Log in to your email and look for password-reset messages you didn't request, or new devices or logins you don't recognize. Do the same with your bank or credit card account — look for charges or transfers you didn't make.

If you typed a bank or credit card password into the fake site, call your bank directly using the number on the back of your card, not a number from the suspicious page or email. Tell them what happened; most banks can freeze the card and watch for fraud.

4. Turn on alerts so you'll notice fast next time

Most banks and email providers let you turn on alerts for new sign-ins or unusual activity. Turning these on means you'll hear about a problem within minutes instead of weeks later.

5. Report the fake site

You can report a phishing page to the company it's impersonating (most banks and major sites have a "report phishing" or "report fraud" page) and to your email provider, which usually has a "report phishing" button right on the message. Reporting it helps get the fake page taken down and can protect other people from the same scam.

None of these steps require you to be a tech expert, and none of them mean you did something foolish. These fake pages are built by people who do this full time, and they're designed to look convincing to anyone — not just to people who aren't careful with computers.

What if the same password unlocks your computer?

If you use that password to log into your Windows PC or Mac, or if you're worried the fake site also tried to install something on your computer, that's a bigger job than changing one password. A computer can pick up other problems from a scam like this — not just a stolen password. PorchswingProtect is made for seniors, works on Windows and Mac, and gives you a real Porchswing person to call if you're not sure what you're looking at. It comes with a 30-day money-back guarantee, so there's no risk in trying it.

What to do if you're stuck

If any of this feels like too much to sort out alone — or you're not sure whether something on your computer or in your accounts still isn't right — that's exactly what we're here for. You don't have to fix this by yourself.

If you want quiet protection on your Windows or Mac computer — with a real Porchswing person to call — learn about PorchswingProtect. Or call us at (916) 521-0065 and we'll help you set it up.

Common questions

Will I lose my money if I typed my password into a fake site?

Not necessarily. Typing a password alone doesn't move money out of your account — a scammer still has to log in and act. Changing your password quickly, and calling your bank if a financial account was involved, is what keeps a stolen password from turning into a real loss.

How do I know if a login page is fake?

Look closely at the web address before you type anything — a fake page's address is often almost right but not quite (an extra word, a misspelled company name, or the wrong ending). When in doubt, don't click the link at all. Go to the real site by typing the address yourself or using a bookmark you already trust.

Should I still worry if I only typed my password, not any other information?

It's worth taking the steps above either way. A stolen password is enough for a scammer to try to get into that account, and into any other account where you used the same password.