In this article
Start with what you actually did. A suspicious link is not proof of a compromised device, and the absence of an immediate problem is not proof that disclosed information is safe. This checklist helps organize a response; it cannot inspect your phone, account or bank.
Stop the interaction first
Close the questionable page and stop responding to its sender. Do not pay an additional “verification” or “refund release” charge to the same party. Do not follow their instructions to install a repair tool or allow remote control. If you need help, choose its source independently.
If you only opened the page
Make a private note of whether you entered anything, downloaded a file or granted a permission. Opening alone is different from those actions. Do not return to the page merely to investigate. If a download or device behavior concerns you, follow your device provider’s official security guidance; this manual does not diagnose malware.
If you entered a password, PIN or code
Use the official service’s account-protection or recovery route from a separate trusted session. Tell its support what kind of information was disclosed and whether you notice an unauthorized change, without publishing the secret in a general chat. For a reused password, review the other affected accounts through their official services too.
If the phone number or service appears to have changed without your authorization, treat it as an account-security question, not merely a bill question. Metro says suspected unauthorized changes require immediate carrier contact. Use its official contact page from another device if needed.
If you entered card details or sent money
Contact the payment provider using the number on the card or its independently opened app or website. Explain the actual sequence: what you entered, what you authorized and what appears in the record. Ask what protective steps and dispute options apply. We cannot promise a refund, decide whether a charge is reversible or tell the provider how to classify it.
The FTC’s linked recovery guidance can help organize next steps for information exposed to a scam. Keep records privately and share only what the receiving official channel needs. Do not post an unredacted receipt or card image to seek public reassurance.
A short handoff that gets to the point
Fictional example: “I followed an unexpected bill link and entered card information. I did not enter my account password. I closed the page. I need to know the appropriate card-protection steps.” This distinguishes known facts from guesses and helps the provider ask the next relevant question.
Return to the payment starting-point guide only when you are ready to handle the genuine bill separately. Use the reporting guide for a minimal incident record.
Evidence and limits
Public sources checked November 4, 2026. The practical sequence and fictional examples are our editorial analysis. This is not a security scan, a fraud determination or an account investigation.
- FTC: Recognize and avoid phishing: Reach the company through a known independent channel, report phishing, and seek recovery guidance for exposed information.
- Metro: Prevent account takeover fraud: Account takeover can affect a wireless number and other accounts; unauthorized changes warrant immediate carrier contact.
- Metro: Contact us: An independently reached directory for customer service and payment help. No call or account inquiry was made.