Clicked a phishing link? What to do in the next ten minutes

First, work out what actually happened

Clicking a link is not the same as being hacked. Think back over exactly what you did. Did the page just open and you closed it? Did you type your email address and password? Did you approve a sign-in prompt on your phone? Did a file download, and did you open it? Did you enter card or bank details? Each answer leads to slightly different steps.

Write it down while it's fresh, including the time, the email or text that contained the link, and what you saw. Don't delete the original message. Your IT contact will want to see it, and it helps them check whether anyone else in the office received the same thing. Try not to panic-delete files, wipe the device yourself or run lots of random clean-up tools from the internet. Well-meant fixes can destroy the evidence IT needs to see what happened, and some 'free cleaner' downloads are themselves malware. Leave the device as it is, apart from any steps below, until someone who knows what they're doing has looked at it.

If you only opened the page

If the page opened and you closed it without typing anything or downloading anything, the risk is low on an up-to-date computer or phone. Close the browser tab, then close the browser completely. Let your IT contact know anyway, because they may want to block the site for everyone and check that nothing ran in the background. Keep an eye out for anything unusual over the next day or two, such as unexpected pop-ups, a slower computer, or emails you don't recognise in your sent items. Mention any of these to IT rather than assuming they're unrelated.

If you typed a password

Assume the password is now in the attacker's hands, possibly within seconds. From a different, trusted device, change that password immediately, and change it anywhere else you've used the same one. In Microsoft 365 or Google Workspace, ask your IT contact to sign you out of all sessions, which kicks out anyone who has already logged in.

Then check your security settings. Look for multi-factor methods you didn't add, such as an unfamiliar phone number or authenticator app, and remove them. Check your mailbox for new inbox rules or forwarding to outside addresses. Attackers often add these within minutes of getting in so they can stay hidden.

If you approved a sign-in or shared a code

Approving a multi-factor prompt you didn't start, or reading out or typing in a code, may have let the attacker straight into your account even if your password was strong. Treat this as urgent. Your IT contact should revoke all sessions, reset your password and review the sign-in logs to see where the attacker logged in from and what they accessed. Some modern phishing kits capture the session itself, not just the password, which means changing the password alone may not remove the attacker. Revoking sessions and re-registering your multi-factor method is what properly closes the door.

If a file downloaded or opened

Disconnect the computer from the network by turning off Wi-Fi or unplugging the network cable. Don't shut it down unless IT tells you to, because they may want to examine what's running. Don't plug in USB drives or connect to shared folders from that machine. Your IT contact will scan the device, check what the file did, and decide whether it needs to be cleaned or rebuilt. If the computer is part of a shared network, they may also check other devices and servers for signs that anything spread.

If you entered card or bank details

Call your bank using the number on the back of the card or on its official website. Ask them to cancel the card, block any pending transactions and watch for unusual activity. If you entered online banking details, change the password and ask the bank to check for new payees or changed limits. If it was a business card, let whoever manages company finances know straight away. Many fraudulent transactions can be disputed if reported quickly, but delays make it much harder.

Why telling someone quickly matters most

The single biggest factor in how much damage a phishing click does is how soon someone finds out. An attacker who gets ten minutes in a mailbox can do far less than one who gets ten days. Telling IT within minutes, even if you feel embarrassed, is the most useful thing you can do. Good workplaces treat a quick report as the right outcome, not a mistake to be punished. If you're a manager, thank the person who reported, help them through the steps, and use the experience to make the next report even easier.