I entered my password on a fake site, what now?
Last reviewed: 2026-08-01 · Checked with Hunch’s on-device engine, the same one inside the extension. How Hunch checks →
Part of our guide: What to do if you got scammed →
Move fast, but this is fixable. The moment a scammer has your password, the fix is to change it before they use it, and to lock down anything that shared that same password. Start now; the steps below are ordered so the most important one comes first.
Got a message like this? Paste it here →
Fake billing warnings target anyone with a subscription, because a 'payment problem' feels urgent and easy to believe. Impersonators copy a familiar brand's look and add a short deadline so you log in without checking the address. It lands hardest on people who reuse one password everywhere, since a single fake login then opens many doors.
Illustrative example of the pattern, not a real message someone received.
How to verify it yourself
- Confirm what you actually typed. If it was only a password, the account itself is the exposure; if you also entered card details, treat the card as compromised too.
- Check whether that password is reused anywhere else. Any other account with the same password is now at risk and needs its own new password.
- Look at the real site's security or 'devices' page for logins you don't recognize, then sign those sessions out.
- Turn on two-factor authentication so that even a correct password won't let a stranger in without the second code.
Common questions
I gave my password to a fake login page how do I fix it
Change that password immediately on the real website, then turn on two-factor authentication. Do it from the official app or by typing the real address yourself, never from a link in the message.
what happens after you enter your password on a phishing site
The page silently sends your password to the scammer, who may try it on the real account and on other sites where you use the same one. Changing it quickly closes that window before they can act.
should I change my password on other accounts too
Yes, on any account where you reused the same password. Attackers routinely try a stolen password across email, banking, and shopping sites, so give each one a fresh, unique password.
how do I know if the scammer already got into my account
Check the account's recent-activity or device-login list and look for logins from unfamiliar places or times. If you see any, sign them out and change the password again after enabling two-factor.
If you already responded
- Change the password for the affected account right now, using the official app or by typing the real address yourself, not the link from the message.
- Turn on two-factor authentication immediately, so a stolen password alone can no longer open the account.
- Change the password on every other account where you used that same one, giving each a unique password so one leak can't unlock several.
- Open the account's device or session list and sign out any login you don't recognize, revoking access from unknown devices.
- If you also typed a card number, call your bank's real number on the back of the card and freeze that card. Then report the site at reportfraud.ftc.gov, and if personal details were exposed, at IdentityTheft.gov. Stay alert for a follow-up message that pretends to 'help' you secure the account.
If you were already hit, expect a follow-up
One more thing to expect: after a scam, your details often land on lists that get reused, so you may be contacted again, sometimes by people posing as investigators, your bank's "fraud team," or "recovery agents" who promise to get your money back for an upfront fee. That follow-up is a second scam. No legitimate service charges a fee to recover funds.
Source: FTC What To Do if You Were Scammed
Hunch is not affiliated with Netflix. Netflix is named only to describe a scam that impersonates it; the real Netflix does not send these messages.