Clicked a phishing link at work? Do these 7 things

It happens to careful people. You click a link, the page looks odd, and your stomach drops.

Take a breath. If you clicked a phishing link at work, what you do in the next hour matters more than the click.

What should I do first if I clicked a phishing link?

Stop, do not click anything else, and tell IT or your manager. That is the first step, and the rest of this list supports it. Say what you clicked, when, and on which device. Do not wait until you are sure it was bad.

Do these 7 things

1. Stop and do not click anything else. Do not enter more details on the page.
2. Tell IT or your manager now. Say what you clicked, when, and on which device.
3. Do not delete the email yet. IT may need it as evidence. Use the “report” button if you have one.
4. Change your password. If you typed a password, change it from a safe device. Change it on any other site that uses the same one. NIST says to change the password for any affected account right away.
5. Turn on multi-factor authentication for that account, if it is not on already. CISA explains MFA here.
6. Update and scan. The FTC says that if you clicked a link or opened an attachment you should update your security software and run a scan.
7. Watch your accounts. Look for strange log-ins, emails you did not send, or payment changes.

What if I typed my password or opened a file?

If you typed a password, the fix is quick: change it now, on a safe device, and turn on MFA. If you opened a file, do not open it again. Tell IT the file name and let them check the device.

Do not log in to the fake page again “to see.” Do not forward the email to coworkers to warn them. Tell IT, and IT will warn everyone the safe way.

What if I gave away sensitive information?

If you gave a Social Security number, bank details or a similar detail, the FTC points US residents to IdentityTheft.gov for steps. Call your bank’s fraud team if money or card details are involved. NIST also says that if a company bank account may be affected, contact the bank immediately and watch for unauthorized transactions.

In Nigeria, tell your bank and your employer’s data protection lead, because a breach may need to be reported. See our NDPA 72 hour guide.

What if the email asked for a payment?

If the message was about money, such as a changed bank account or an urgent transfer, treat it as fraud even if you did not click. Read business email compromise: how small firms get tricked and tell your finance lead today.

What do managers and IT do next?

The manager’s job is to make reporting safe and to contain the damage.

• Thank the person. Do not shame them.
• Reset passwords and sessions for that account.
• Search for the same email in other inboxes and remove it.
• Check for forwarding rules or new devices on the account.
• Write down what happened and what you changed.
• Share an anonymous example with the team so others can learn.

A simple blame-free rule helps. If people fear punishment, they hide mistakes, and hidden mistakes are the expensive ones.

How do I report phishing?

Report it to your own IT team first, then to the outside services below.

• Use the report option in your email app.
• Tell your IT team.
• In the US, forward emails to reportphishing@apwg.org and text messages to 7726 (SPAM), and report to ReportFraud.ftc.gov. These routes come from the FTC.
• NIST also advises reporting phishing to the FBI’s Internet Crime Complaint Center.

How do I make clicking less likely next time?

Short lessons and safe practice emails work better than one long yearly talk. NIST says to teach employees how to spot and report a phish, and to train regularly. See how often to run security awareness training for a simple schedule.

You can try a free phishing risk test for up to 25 staff, paste a suspect message into Is this phishing?, or take the Free Phishing 101 mini-course.

Want to practise safely? See how phishing simulation works for a small business on Skillermatic.