What To Do If You Clicked A Phishing Link
The first ten minutes matter more than anything else, and almost nothing that happens in them should be done quietly.
In short: if you clicked a phishing link, tell someone immediately, because the first ten minutes matter more than anything else. Disconnect from the network but do not power the machine off, change the password from a different device, and do not delete the email. Nobody here is in trouble for clicking. The delay in reporting is what causes the damage.
You Clicked A Phishing Link: Tell Someone Immediately
This is the whole article. Everything else is detail.
The single biggest factor in how badly a phishing incident goes is how long it takes for someone to say something. Attackers are not fast because they are clever. They are fast because nobody reports the click for four hours, and four hours is enough to read a mailbox, set a forwarding rule and send an invoice to a supplier.
Nobody is in trouble for clicking. These emails are designed by people who do this professionally, and they are aimed at busy people doing their jobs. The person who reports it in two minutes has done something genuinely valuable.
Disconnect, But Do Not Power Off
Unplug the network cable or turn off Wi-Fi. That stops anything spreading and stops an attacker who has a foothold from doing more.
Do not shut the machine down. Do not restart it. Memory contents can tell an engineer what actually ran, and that evidence disappears at power off. It can be the difference between knowing what happened and guessing.
Change The Password From A Different Device
If you entered credentials on the page, change that password now, from your phone or another computer rather than the machine you clicked on. If the same password is used anywhere else, and it usually is, change it there too.
If multi-factor authentication is enabled, and you approved a prompt you did not expect, say so explicitly. An approved prompt means the attacker may already be inside the account, and that changes what has to happen next.
Do Not Delete The Email
The instinct is to make it disappear. Resist it. That email is the primary evidence, and an engineer needs the headers to work out where it came from, who else received it and whether the sender is a genuine account that has been compromised.
If you have already deleted it, say so and check the deleted items folder before emptying it.
What Happens Next
An engineer will check the account for forwarding rules, unfamiliar sign-ins and mailbox rules that hide replies, because those are what a real intrusion leaves behind. The machine gets examined and, if needed, rebuilt. Other people who received the same message get warned.
Expect questions, and expect to be asked the same thing twice. It is not doubt about your account. It is the way the timeline gets built.
Questions People Ask After They Click
The worries we hear most on the security line, answered.
Probably, but report it anyway. Some pages attempt to run something on the click alone, and confirming that nothing happened takes an engineer a few minutes.
No. The people who report immediately are the reason incidents stay small. Any organization that punishes reporting ends up with people who hide it, which is far more dangerous.
Tell your IT contact and let the warning go out centrally. A forwarded copy of a live phishing email is itself a risk, and a rushed all-staff email often causes more clicks.
You usually cannot tell from the outside, which is why it is checked properly. Sign-in logs, forwarding rules and mailbox rules are the things that reveal it, and those need admin access to read.
How A Phishing Link Actually Does Damage
A phishing link usually does one of two things. Most often it opens a copy of a real sign-in page, built to collect whatever you type into it. Less often it starts a download that tries to install something on your machine.
That is why the engineer’s questions are so specific. Did you type a password? Did anything download or open? Did you approve a prompt afterwards? Each answer points to a different cleanup.
Either way the clock starts at the click. How much damage a phishing link does depends far less on how clever the email was than on how quickly someone looks.
What People Get Wrong After They Clicked A Phishing Link
Waiting to see whether anything happens. By the time something visible happens, an attacker has usually been in the mailbox for days.
Running a virus scan and calling it done. A scan looks for malicious files. It cannot see a stolen password being used from somewhere else, which is the more common outcome.
Forwarding the email to colleagues to ask whether it looks real. Every forward puts the phishing link in front of another person. Report it once, to us, and let us warn the rest.
Clearing the browser history after you clicked a phishing link. It removes the record of which page opened and when, which is part of what the engineer needs to see.
Assuming the spam filter would have caught it if it were dangerous. Filters stop most phishing, not all of it, and the messages that get through are the convincing ones.
Who To Call When You Clicked A Phishing Link
Call the 24/7 security line on 678-374-4352 and press option 1. Do not open a ticket and wait, and do not email, because email may be the account that is compromised.
Say that you clicked a phishing link, roughly what time, whether you typed anything and whether you approved a prompt. That is enough for an engineer to start.
If it happens after hours, call anyway. The line is answered around the clock, and an evening phone call costs far less than a Monday morning discovery.
If you clicked a phishing link on a personal phone that also has your work email on it, say so. That phone is part of the investigation too.
Clicked A Phishing Link Just Now?
Stop reading and call 678-374-4352, option 1. The rest of this page can wait until an engineer is on the line.
CISA also publishes guidance on recognizing and reporting phishing that explains what happens after a report is filed.