I clicked a phishing link. What should I do now?
Tell IT straight away, even if nothing seemed to happen; speed matters more than embarrassment. Then, with IT: if you typed a password on the page that opened, change that password from a different, trusted device and end all active sessions for the account. If a file downloaded or opened, disconnect the computer from the network, by unplugging the cable or turning off Wi-Fi, but leave it switched on so it can be examined. Note the time, the message and the link so IT can block it for everyone and check who else received it. If you only opened the page and entered nothing, the risk is lower, but IT should still check the device with its security tools. Over the following days, watch for unexpected login prompts, MFA requests you did not start, or replies to e-mails you never sent.
Read next
Related questions
- I entered my work password on a phishing page. What now?
- An employee entered their password on a phishing page. What should we check on the network?
- How do you clean a computer after a phishing click?
- After a phishing click, how do attackers get from one laptop to the rest of the network?
- Should employees report a phishing e-mail even if they did not click it?
← All 29 questions on Phishing and e-mail aftermathAll topics