The first hour after someone clicks a phishing link

What exactly happened?

Ask the person calmly. People who expect blame report later, and time matters here. Five questions sort it out:

1. Did they only open the page, or type something into it?
2. Was it their work password, or a password they also use elsewhere?
3. Did they approve a sign-in prompt or type a code they didn’t ask for?
4. Did they download or open a file, or allow something to install?
5. Did they enter, change or approve any payment details?

A click with nothing typed usually needs a scan and a watchful eye. A typed password or an approved prompt means you treat the account as taken over. Write down the time, the sender and what was typed. Keep the message and report it with your email’s report button rather than deleting it.

Minutes 0–10: how do you contain it?

1. If a file was opened, disconnect the computer. Unplug the network cable and turn off Wi-Fi. Leave it switched on so it can be checked.
2. Phone your IT contact or admin. Use the phone or a chat app, not email from the affected account.
3. Don’t forward the phishing email to colleagues to warn them. Describe it instead.
4. If payment details were typed or money was sent, call your bank now. Don’t wait for the end of the hour. The FBI’s Internet Crime Complaint Center says to contact your bank as soon as fraud is recognized and ask for the transfer to be recalled (IC3: business email compromise).

Minutes 10–30: how do you lock the account?

An admin does these steps. If nobody in your office has admin access, that is your cue to call for help now.

On Microsoft 365:

1. Block sign-in or reset the password. Microsoft recommends disabling the account during the investigation and, if you can’t, resetting the password. Never send the new password by email, because the attacker may be reading that mailbox (Microsoft: respond to a compromised email account).
2. Revoke sessions. In the Microsoft Entra admin center, open the user and select Revoke sessions. Some apps can keep working until their access token expires, which by default is about an hour (Microsoft: revoke user access in an emergency). Carry on with the checklist rather than waiting.
3. Check sign-in methods. Remove any phone number or authenticator app you don’t recognize. Attackers add their own so they can get back in.
4. Check app access. Remove apps the user approved that you don’t recognize. App passwords are not revoked by a password reset, so delete those too.

On Google Workspace:

1. Reset the password, then reset sign-in cookies. Google’s steps for both are in the Admin console, and resetting cookies stops the old password from being used to sign back in (Google: reset a user’s password).
2. Know the limit of a cookie reset. It signs the user out of browsers and mobile devices, but Google notes it doesn’t sign them out of some installed apps (Google: sign a user out).
3. Open the user’s security settings. Check 2-Step Verification, revoke app passwords and remove connected third-party apps you don’t recognize (Google: manage a user’s security settings).

Minutes 30–45: what did the attacker change?

Attackers rarely just read mail. They set things up so they can keep watching after you reset the password. Check each of these:

• Forwarding. In Microsoft 365, check the mailbox forwarding setting. In Gmail, look under Settings > See all settings > Forwarding and POP/IMAP (Google: automatic forwarding).
• Rules and filters. Look for rules that forward mail, delete it, or move it to folders nobody opens, such as RSS Subscriptions, Notes or Junk Email. These hide replies from the real user. Microsoft lists forwarding rules and rules that move mail to those folders as common signs of a compromised mailbox, and admins can list hidden rules with PowerShell (Microsoft: respond to a compromised email account). In Gmail, check Filters and Blocked Addresses (Google: create rules to filter your emails).
• Sent Items and Deleted Items. Messages the person didn’t write tell you who else to warn.
• Admin roles. Make sure the account didn’t gain any.
• Sign-in history. In Microsoft 365, the Entra sign-in logs show IP addresses, locations and times. The first odd sign-in tells you when the trouble started.

Take a screenshot of each rule or setting before you delete it, so you have a record of what changed and when.

Minutes 45–60: who needs to know?

• Your staff. Tell them by phone, chat or in person. Describe the message and ask anyone who got it to report it, not delete it. Ask your admin to check whether the same message reached other mailboxes.
• People who got mail from the account. Call customers and vendors who may have received messages from it. Ask them to ignore those messages and not to act on any new payment instructions.
• Your bank, if money moved. Ask for a recall of the funds, then file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov (IC3: business email compromise).
• Anyone asking to change payment details. Confirm by phone, using a number you already have, never one from the email. CISA gives the same advice for any suspicious message: contact the sender through a method you find yourself (CISA: recognize and report phishing).
• Your insurer and attorney, if relevant. If you carry cyber insurance, check its notice requirements. If customer or employee information may have been exposed, ask your attorney about notification duties.

What should happen after the first hour?

• Check the computer. Scan it with your endpoint protection. If a file ran, have it checked properly before anyone uses it again.
• Turn on multi-factor sign-in for every account if it isn’t on already. Microsoft calls it essential for accounts with admin rights (Microsoft: respond to a compromised email account).
• Block automatic forwarding to outside addresses unless someone has a real business need for it.
• Run a short staff refresher. Show the real message and point out what made it convincing.
• Write a one-page note. What happened, when, and what you changed. You will want it if the same trick comes back.

Our cybersecurity services cover this clean-up, from account lock-down to the written note. If your office runs on Microsoft 365, our Microsoft 365 support includes phishing response, mailbox rule checks and multi-factor sign-in for every user.

When should you call for help?

Call right away if any of these are true:

• An admin account was involved.
• Money moved, or payment details were changed.
• More than one person entered their details.
• A file ran, or the computer is behaving oddly.
• You found forwarding, rules or sign-ins you can’t explain.
• Customer or employee information may have been exposed.
• Nobody in the office has admin access or feels sure about the steps above.

Need help?

If someone just clicked, call us at (330) 741-1331. You can also email support@compitservice.com from an account that was not affected, or use our contact page. Once things are calm, our free security assessment checks your accounts, sign-in security and email filtering, so the next phishing message has a harder time getting through.