Start with the right checks.
A convincing page can collect information without visibly breaking the computer. The next step depends on what you entered, downloaded or approved.
What to do next.
From a trusted route, open the real provider’s account security page and change the exposed password if you can.
If that password was reused, address the other affected accounts with unique replacements.
Review the provider’s session and recovery guidance and tell business support about any approval prompt or download.
If payment information or money was involved, contact the bank or payment provider through a known route promptly.
Check the result.
Check actual account activity and recovery methods rather than assuming a password change alone ends the review. Keep the suspicious message available for investigation.
Stop and get help if…
You cannot regain access, business data may be involved or money was sent. The relevant provider, organization or bank may need to act alongside technical support.