It happens to careful people. An invoice that looks like it’s from a vendor you actually use, a “your mailbox is full” warning, a shared document from someone you emailed last week. Someone clicks, maybe types in their password, and a minute later realizes something was off.
What happens next matters more than the click. Here’s what to do, in order, if someone at your business clicked a phishing link.
First: don’t punish the person who told you
The most valuable thing in a phishing incident is speed, and speed depends on people reporting right away. If the employee who clicked gets embarrassed in front of the office, the next one will stay quiet. Thank them, then move.
In the first 15 minutes
- Disconnect the device if anything was downloaded or opened. If they opened an attachment or ran a file, unplug the network cable or turn off Wi-Fi on that computer. Don’t shut it down yet if your IT team may want to look at it. Just get it off the network.
- Change the password from a different device. If they entered a password on the fake page, change it right away from a phone or another computer, not the one that clicked. NIST’s small business guidance says the same: change the affected password immediately, and if it was reused anywhere else, change those too (NIST).
- Sign the account out everywhere. In most cloud email platforms, an admin can revoke the user’s sessions so anyone who grabbed a session is kicked out. Changing the password alone doesn’t always end a session that’s already open.
- Check that multi-factor authentication is on, and see if it was used. If the person got an MFA prompt they didn’t expect and approved it, say so now. That changes how serious the incident is.
In the first hour
5. Look for the signs of a mailbox takeover. Attackers who get into a mailbox usually do a few quiet things:
- Create inbox rules that forward mail outside the company or move replies to a hidden folder
- Send the same phishing email to everyone in the contact list
- Watch for invoices and reply with “updated” bank details
Check the user’s inbox rules and sent items. If you see forwarding rules you didn’t create, that’s confirmation.
6. Warn the office, and maybe your customers. Send a short note internally: “There’s a phishing email going around that looks like X. Don’t click it. If you did, tell us.” If the account sent messages out, let the recipients know too.
7. Call the bank if money or banking logins were involved. If anyone entered banking credentials or changed payment details, contact your bank’s fraud department now and watch for unauthorized transactions (NIST). Wire fraud is time-sensitive.
8. Report it. You can report phishing and online fraud to the FBI’s Internet Crime Complaint Center at ic3.gov. CISA also has guidance on recognizing and reporting phishing.
In the next few days
9. Find out what the account could reach. A compromised mailbox is often the start, not the end. Ask what that person had access to: shared drives, accounting software, customer data. If personal information about customers or employees was exposed, you may have notification duties. NIST points business owners to their state attorney general’s guidance on breach notification (NIST).
10. Scan and clean the device. If a file was opened, have the computer scanned with your endpoint protection, and rebuilt if anything was found.
11. Write down what happened. Note what the email looked like, who clicked, what was entered and what you changed. It helps if this turns into an insurance claim or the same lure comes back.
What not to do
- Don’t reply to the sender or click “unsubscribe.” It confirms the address is live. NIST advises not engaging with the sender at all (NIST).
- Don’t just delete the email and hope. Take a screenshot or forward it to whoever handles your IT first, so they can block the sender and check whether anyone else got it.
- Don’t wipe the computer right away. If you need to know what happened, the device is evidence. Disconnect it and let your IT team decide.
- Don’t reuse the old password with a number added. Pick a new, unique one.
What this looks like with the right tools in place
For the businesses we support, much of this is caught or contained by layers that work together. Email security quarantines many lures before anyone sees them. Clients regularly forward us suspicious messages to check, like a recent fake invoice that had been quarantined, and we confirm whether they’re safe. Managed detection and response alerts flag things like a sign-in to a cloud mailbox from a known-malicious IP address, so we can investigate and act on the account. MFA on every account makes a stolen password far less useful.
None of these layers is perfect on its own, which is why we use several: MFA, endpoint detection and response, managed detection and response, email security, security awareness training, vulnerability monitoring and tested backups.
How to make the next click less likely
- Train people with real examples. Short, regular phishing awareness training works better than a once-a-year video. Show staff the actual lures that hit your company.
- Make reporting easy. A “report phishing” button or a simple “forward it to us” rule gets you faster warnings.
- Require MFA everywhere, and use phishing-resistant methods where you can (NIST).
- Verify payment changes by phone, using a number you already have, never the one in the email.
- Keep software updated, so a malicious attachment has fewer holes to use.
Not sure how exposed you are?
If a phishing scare made you wonder what else is out there, start by finding out where you stand. We’ll look at your email security, MFA coverage, endpoint protection and backups, and tell you plainly what we’d fix first. Read more on our cybersecurity page, see how security fits into our managed IT support, or request a free IT & security assessment.
Frequently asked questions
What should I do immediately if an employee clicked a phishing link?
Disconnect the device if anything was downloaded, change the affected password from a different device, sign the account out of all sessions, and check that multi-factor authentication is on.
Is clicking a phishing link enough to get hacked?
Sometimes, but the bigger risks usually come from entering a password on a fake page or opening a malicious attachment. Treat any click as a reason to check, not panic.
How do I know if our business mailbox was compromised?
Look for inbox rules you didn’t create, especially ones that forward mail outside the company, sent messages the user doesn’t recognize, and sign-ins from unfamiliar locations.
Where do we report a phishing attack?
You can report phishing and online fraud to the FBI’s Internet Crime Complaint Center at ic3.gov. If banking information was involved, contact your bank’s fraud department right away.
How can a small business reduce phishing risk?
Use email security filtering, require multi-factor authentication, run regular security awareness training, verify payment changes by phone and keep software updated.