Clicked a delivery scam text? Three AI answers agreed on resets—and diverged on the checks

The important phrase was “I do not remember”

The person explicitly said they entered no information. For installation and permissions, however, they said they did not remember doing either. A useful answer should convert that uncertainty into checks instead of silently treating it as proof that nothing happened.

I received a text saying my delivery address was wrong and tapped its link on an Android phone. The page looked suspicious, so I closed it immediately. I entered no name, card number or password, and do not remember installing an app or granting permissions. Nothing unusual is visible, but I am worried. Should I reset the phone and change all my bank passwords? What should I do now?

ChatGPT: useful branches, but one trigger was too broad

ChatGPT advised avoiding the link, checking Play Protect, inspecting recent apps and reviewing downloads. It separated conditions for stronger account action. It was also the only response to present external source links directly in the collected answer.

One item in its escalation list was simply using a banking app to transact or authenticate. The explanation immediately after the list concerned banking on a malware-infected device. Leaving that context out of the item could turn ordinary bank-app use into an emergency trigger. Tie it to suspected compromise or exposure.

The suggestion to watch transactions for “today” should not become a one-day all-clear rule. Likewise, its KISA-attributed statement about clicking alone should not be expanded into a universal guarantee against web attacks. Our final checklist uses separately checked Google and FTC guidance.

Opened a financial app to transact or authenticate. [Translated excerpt]

Gemini: clearing history is not a cure

Gemini organized downloads, scanning, browser-data deletion and Korean carrier-payment or identity-protection measures into four blocks. Each had a verification step, making the proposed actions easy to follow.

But one verification checked whether browsing history was gone, while the stated goal was complete removal of malicious scripts or tracking sessions. Chrome documentation [2] describes deletion of selected browser data. It does not make disappearance of history a substitute for inspecting apps or resolving an infection.

The extra financial prevention services also needed to be distinguished from urgent response to this particular click. In an English-language guide, Korean carrier billing controls and identity services are not universal instructions. In the US, the FTC reporting route in [3] is a relevant local option; bank contact should still use the bank’s own verified channel.

Delete all browsing history, cookies and cache to completely remove malicious scripts or tracking sessions from the opened page. [Translated excerpt]

Claude: the best permissions checklist, weakened by certainty

Claude explicitly separated installed apps from accessibility and device-administrator permissions. That addressed the question’s uncertainty about what had been allowed. Its expandable six-step presentation also made the procedure easier to scan.

Then it said an empty APK download list meant there had been no installation attempt. The present contents of one list cannot establish the complete history of the device. That conclusion also undermines the value of its own app and permission checks.

Its closing instruction to move on if nothing was found was too final. A better ending says that no findings do not justify an unnecessary reset, while retaining a response path for new warnings, unfamiliar apps or account activity.

If there is none, that means there was no installation attempt at all. [Translated excerpt]

The longest answer was ChatGPT’s

Excluding whitespace, the captured screen text contained 1,145 Korean characters for ChatGPT, 866 for Gemini and 744 for Claude. These counts include source labels and response controls, so they describe the captured experience rather than a perfectly isolated prose measure.

ChatGPT used its space for references and escalation conditions. Gemini repeated verification labels after its steps. Claude used a shorter checklist. For this particular scenario, WekeyLab AI would start from Claude’s structure, after correcting its claims about empty downloads and conclusive safety. This is a judgment about these responses, not a ranking of the services’ overall security capabilities.

WekeyLab AI: replace uncertain memory with checks

Do not reopen the link. Inspect installed apps, downloads and permissions without opening unfamiliar files. There is no reason to start by indiscriminately deleting the history that may help you understand what happened.

Google’s Android guidance [1] covers Play Protect, updates, untrusted apps and account checks, with further help or resetting if symptoms persist. Checking system and security updates was missing from all three responses, so it belongs in the revised plan.

Exposure of credentials, unfamiliar privileged apps or suspicious transactions changes the response. Where financial information is involved, use another trusted device and the institution’s verified contact details. Do not use the contact route in the suspicious text. The FTC gives the same official-contact principle [3].

A reset deletes data and requires preparation [4]. It should solve an identified problem, not serve as a reflexive answer to anxiety. Equally, a clean scan is not a certificate that nothing happened. Keep the action proportional to what the checks reveal.

WekeyLab AI’s revised advice A click alone is not a reason to start with a factory reset. Check installed apps, downloads and permissions, then use your device’s security checks and updates. If nothing suspicious appears, do not rush into wiping it. If unfamiliar apps, permissions, account warnings or transactions appear, use another trusted device to obtain official support and decide the next action.