2026 Black Friday Promotional Email: What to Do After Clicking a Suspicious Link?

Clicking alone does not prove your account is compromised. Stop interacting with the suspicious page, then act based on whether you entered a password, payment details, or other personal information. A separate inbox can help organize promotions, but it cannot prevent phishing or undo information you already submitted.

This is for you if: You clicked an unfamiliar Black Friday offer and want to know whether your account needs attention.
If you entered a shopping password, start with the retailer’s official account tools.
If you submitted payment or identity details, use the relevant official service’s contact channel.

Last updated November 4, 2026. Guidance checked against CISA’s holiday shopping tips and the FTC’s phishing guidance. These sources provide general consumer guidance; they do not establish that a specific 2026 Black Friday campaign or incident has occurred.

First, stop interacting with the page

Close the suspicious tab. Don’t click more links in the email, download an attachment, enter information, or use a phone number shown on the page. Don’t try to unsubscribe through that message either. An unsubscribe link is still a link controlled by the sender, and using it may take you back to the same questionable site.

Save the email if you need to report it or review what happened. Note the sender address, the subject line, the time you received it, and the web address shown in your browser. If you can do so without reopening the page, keep a screenshot of the message or page. Don’t forward the message to friends to ask whether it looks real; they could follow the link by mistake.

A click is not the same thing as entering your password or payment details. It does not, by itself, prove that someone has taken over your shopping account. But don’t assume the visit was harmless if you downloaded a file, approved a notification, installed something, or entered data. Your next step depends on what happened on the page.

A page can imitate a retailer’s branding and still be controlled by someone else. The logo and the offer are clues to investigate, not proof of authenticity.

If you downloaded a file or installed an app, don’t open it again. Follow your device maker’s security guidance and use trusted security software to check the device. The FTC recommends updating security software and scanning a device if you suspect malware; see its advice on protecting against, detecting, and removing malware. Don’t install a scanner advertised by the suspicious page.

Next, check whether you submitted anything

Work through this short action list before you decide the incident is over. Check each item that applies to what you did, not what the email appeared to ask for.

• [ ] I only opened the link. Close the page, don’t revisit it from the message, and verify the promotion independently. Report the email using your provider’s phishing or junk-reporting option.
• [ ] I entered a shopping password. Go to the retailer through its official app or a web address you already know. Change the exposed password, review account activity and contact details, and follow the retailer’s current security instructions.
• [ ] I reused that password. Change it on each other account where you used it. Don’t use the link in the email to sign in or reset it.
• [ ] I entered card or payment information. Contact the card issuer or payment service through its official app, the number on the card, or a known official website. Explain what you entered and ask what action they recommend.
• [ ] I entered identity or other sensitive information. Contact the organization responsible for that account or information through a verified channel. For possible identity theft, use the official IdentityTheft.gov recovery steps.
• [ ] I downloaded or installed something. Stop using it and follow trusted device-security guidance, including the FTC’s malware detection and removal advice.

This checklist is a triage tool, not a guarantee that an account is safe or that a particular service can reverse a transaction. Don’t assume you are protected just because you changed one password. If you submitted several kinds of information, contact each relevant account or payment provider through its own verified support channel.

Then, verify the offer outside the email

Open the retailer’s official app if you already use it, or type a web address you know is correct. Search the retailer’s sale pages for the promotion. If the offer isn’t there, contact the retailer through customer-support details published in the app or on its independently opened website.

This is the safer way to check a Black Friday promotion because it avoids relying on the message’s own route to the offer. CISA’s holiday shopping guidance advises shoppers to use trusted sources and take care when following links. The FTC also warns that phishing messages can appear to come from familiar organizations. A display name, retailer logo, persuasive copy, or unusually attractive discount is not enough to authenticate the sender.

Don’t use the email’s “contact support” button, reply address, or phone number to confirm the deal. Those details may lead back to the sender rather than the retailer. If you need help, find the contact route separately. For more on evaluating a sender and reaching the real offer page, use this guide to email privacy decisions as a starting point for separating message claims from independently verified information.

If you entered a shopping password, secure the account

Use the retailer’s official sign-in route, not a saved link in the suspicious email. Change the exposed password and review recent activity, saved addresses, phone numbers, payment methods, and account contact details. Look for changes you didn’t make, orders you didn’t place, or messages about account changes you don’t recognize.

Follow the retailer’s own help instructions for reporting suspicious activity or securing the account. Each company may have a different process, so don’t assume that a password change alone resolves the issue. If you can’t sign in, use the retailer’s account recovery process from its official website or app. Avoid recovery links delivered by the suspicious message.

If you used the same password on other services, change it on those accounts too. Give extra attention to email accounts and payment services that could be used to reset or access shopping accounts. Use a different password for each account. If you have trouble deciding which accounts to check, start with those that share the exposed password or can reset the shopping account.

The FTC’s guidance for people who have been scammed recommends contacting relevant companies and taking steps to secure affected accounts. That is general guidance, not a promise that a particular retailer can restore an account or reverse an order. Keep notes of what you changed and whom you contacted so you can give consistent details if you need to follow up.

If you submitted payment or personal details, contact the right service

Use the type of information you entered to decide whom to contact. If you submitted a credit or debit card number, contact the card issuer using the number on the card or its official app. If you used a payment service, contact that service through its own app or known official website. Tell them what you entered and ask whether they recommend additional steps for your account or payment method.

If you submitted information for a retailer account, contact the retailer through its verified support route as well. If you entered identity information or details for another financial or personal account, contact the organization that manages that account. Follow its instructions rather than relying on advice from the suspicious page or an unsolicited caller.

Keep the original email and any available records of the page, transaction, or support conversation. Don’t delete confirmation messages or records you may need to explain what happened. If you provided card information, the FTC’s guidance on lost or stolen payment cards explains how to contact the relevant card provider. Its identity theft steps offer a route for people who believe their personal information has been misused.

Don’t rely on a specific response deadline, refund, or recovery outcome unless the relevant provider confirms it. A provider can tell you what applies to your account and what action it can take. Preserve the case or reference details it gives you, and use the same official channel if you need to check the status later.

After the immediate checks, clean up the inbox carefully

Report the suspicious message using the reporting option provided by your email service. Don’t click its unsubscribe link to stop future messages. If a retailer’s legitimate marketing emails are unwanted, unsubscribe only after you have verified the sender and the destination independently. If you’re unsure, report or filter the message rather than following its links.

Separate low-stakes promotion signups from messages you need to keep. Order confirmations, shipping updates, refunds, returns, support replies, and account-recovery messages need to reach an inbox you can continue accessing. A one-time address or promotional inbox may be useful for sorting optional marketing, but it is a poor choice for a purchase you may need to track or an account you may need to recover.

An independent address for promotions does not validate an email or make a landing page safe. It can help distinguish marketing from order-related mail, but it cannot stop a phishing message from reaching you, establish that an offer is genuine, or retract information you submitted. For a closer look at the limits and use cases of temporary addresses, read this disposable email guide.

Quick answers

I opened the link but didn’t fill in a form. What now?
Close the page and avoid reopening it through the email. Check the offer through the retailer’s official app or a known address you enter yourself. If you didn’t submit data, download a file, or install anything, a click alone does not establish that your shopping account was compromised. Report the email through your provider’s tools.

I typed my shopping password into a page that may be fake. What comes first?
Go to the retailer’s official app or type its known address yourself. Change the exposed password, review account activity and contact details, and follow the retailer’s current help instructions. If the password was reused on another account, change it there too. Use only verified recovery and support routes.

How do I check whether the Black Friday deal is real?
Search for it in the retailer’s official app or on its website, opened independently of the email. If you need confirmation, use support details published there. Don’t trust a logo, display name, or discount claim on its own, and don’t use the suspicious message’s links or contact details to verify its claims.

Will a separate promotional inbox protect me from phishing?
No. It may help keep marketing messages separate, but it cannot tell you whether an email is genuine or protect you from a deceptive link. Use an inbox you can keep accessing for order updates, refunds, customer support, and account recovery. Treat any unexpected promotion as something to verify through the retailer directly.

If you want a separate address for a low-stakes promotional signup, review MaskSend’s options and decide whether that address suits the messages you expect to receive. Keep orders, refunds, returns, and account recovery tied to an inbox you can access long term. A separate inbox can organize promotions; the safer response to a suspicious link is still to stop, verify independently, and contact the affected provider through its official channel.

Frequently asked questions