What to do after clicking a phishing link

It happens to careful people. A link looked real, you clicked, and something felt wrong. What you do in the next hour matters more than the click itself. This guide gives the steps for the person who clicked and, separately, for the admin who has to clean up.

What exactly happened? Work out your risk first

Different actions carry different risks. Be honest about which one applies; your IT team needs to know.

What should you do in the first 15 minutes?

1. Stop interacting with the message. Don't reply, forward it to colleagues, or click again.
2. If you downloaded or opened something, disconnect. Turn off Wi-Fi or unplug the network cable on that device. Don't wipe it yourself; IT may need it.
3. Change your password from a trusted device. Type the real address yourself or use a bookmark; CISA advises going to the company's verified website rather than using links in the message. Pick a new, unique password.
4. Change it anywhere else you reused it. Attackers try stolen passwords on other services. Google also says to change passwords for sites tied to your email address.
5. Sign out of other sessions. Your account security page usually has a "sign out everywhere" or device list. In a business account, ask your admin to revoke sessions (see below).
6. Turn on MFA, or check it. If it was already on, look for methods or devices you didn't add.
7. Tell your IT team or provider now. Give them the time, the link or sender, and what you entered. Early reports let them block the same message for everyone else.

Don't wait to be sure. A false alarm costs minutes; a hidden compromise can cost much more.

Write down what you remember while it's fresh: when you clicked, which device you used, what the page asked for, and anything you typed or approved. If you're not sure whether you entered a password, say so. Your IT team would rather treat it as a compromise and be wrong than miss one.

What should an admin do when a user's account is compromised?

If the user entered a password or approved an MFA prompt, treat the account as compromised. Microsoft's guidance for compromised accounts comes down to this: block or reset the account, revoke sessions, remove app passwords, check MFA methods, app consents and admin roles, remove malicious forwarding and inbox rules, then investigate the sign-in and audit logs. Attackers rely on the step you skip.

Don't improvise it. Our compromised email account checklist is the full recovery procedure for Microsoft 365 and Google Workspace, including the PowerShell for finding hidden rules. If Microsoft 365 has already blocked the account with a 550 5.1.8 bounce, see Microsoft 365 user blocked from sending before you unblock it.

How do you check for malicious mailbox rules and forwarding?

Attackers often set up rules so they keep receiving copies of your mail, or so warning replies vanish. Microsoft lists these as common symptoms: rules that forward mail to unknown addresses, and rules that move messages to Notes, Junk Email or RSS Subscriptions.

• In Outlook on the web: open Settings > Mail > Rules, and Forwarding. Delete anything you didn't create. Hidden rules only show up in PowerShell, so ask your admin to check too.
• In Gmail: open Settings > See all settings and check Filters and Blocked Addresses, Forwarding and POP/IMAP, and Accounts (for delegated access). Also check the auto-reply and signature for changes.

What to look for

If the account sent mail, warn the recipients through a separate channel. Your contacts are the next targets.

What if you entered payment or personal details?

• Call your bank or card issuer using the number on your card or statement. Ask them to block the card or recall any transfer.
• Use IdentityTheft.gov if you gave personal or financial information. The FTC says it gives specific steps based on what you lost.
• For business losses, such as a payment sent to a fake supplier, report to the FBI's IC3 after calling the bank. IC3 is the FBI's central hub for reporting cyber-enabled crime, including business email compromise. IC3 also warns that it never contacts victims directly to recover funds, so ignore anyone who claims to.

What if you opened an attachment or downloaded a file?

The FTC advises updating your security software, running a scan, and removing anything it flags. In a business, hand the device to IT instead. They may want to isolate it, check what ran, and reinstall it. Keep it off the network until they say otherwise. Our guide to dangerous email attachment types explains which files carry the most risk.

How do you report the phishing email?

1. Use your mail app's report button ("Report phishing" or "Report junk"). This alerts your provider and, in many businesses, your IT team.
2. Tell your IT team if you're at work, even if you already used the button.
3. Forward it to the Anti-Phishing Working Group at reportphishing@apwg.org, as the FTC suggests.
4. Report fraud to the FTC at ReportFraud.ftc.gov.
5. If it impersonated a company, tell that company through its official website.

Our guide on how to report a phishing email has the exact steps for Outlook, Gmail and Apple Mail, and the UK and US reporting addresses.

If you're an admin, look at the message headers to see where it came from and whether it passed authentication. The Email Header Analyzer runs in your browser and shows SPF, DKIM and DMARC results; our guide on how to read email headers explains them.

How do you stop it happening again?

• Use phishing-resistant MFA. CISA says the only widely available phishing-resistant authentication is FIDO/WebAuthn, such as security keys and passkeys. Any MFA is better than none.
• Block automatic external forwarding at the organization level unless there's a business reason for it.
• Filter mail before it reaches inboxes. Fewer phishing messages delivered means fewer chances to click. See how to stop phishing emails in Microsoft 365.
• Protect your own domain with SPF, DKIM and an enforced DMARC policy, so attackers can't send exact-match spoofs of your address.
• Make reporting easy and blame-free. People who feel safe reporting a mistake report it faster.

Next steps

• If you entered a password: change it, sign out all sessions and check your rules and forwarding now.
• If you're an admin: work through the Microsoft or Google checklist above for the affected account, including app passwords and consents.
• Check the phishing message's headers in the free Email Header Analyzer.
• Review your email security checklist, including MFA and inbound filtering. If you want filtering in front of every mailbox on a domain, see how iBlockSpam works.

Browse our other phishing and threat guides.