Clicked a Phishing Link? What to Do in the First 24 Hours

First, a word about the click

Phishing works because it looks like ordinary work: an invoice, a shared file, a recruiter, a message from the boss. Careful, smart people click. What matters most is what happens in the next hour.

The person who reports a click within minutes has done the most useful thing anyone can do. If you lead the business, make that easy. Thank them, then get to work. Blame teaches people to stay quiet next time, and quiet is what turns a small problem into a large one.

What should we do in the first hour?

Work through these in order. Most take a few minutes each.

1. Report it. The person who clicked tells their manager and your IT provider right away, including what they clicked, when, and anything they typed in or downloaded.
2. Disconnect the device if malware is possible. If a file was opened or downloaded, or the computer is behaving strangely, turn off Wi-Fi or unplug the network cable. Leave it powered on unless your IT provider says otherwise, so they can see what happened. If your provider's security tools can isolate the computer remotely, they may do this step for you.
3. Reset the password from a clean device. Use a different computer or phone, not the one that clicked. Then choose the option to sign out of all other sessions. That step matters as much as the new password: some phishing pages capture the signed-in session itself, so a password change alone may not shut the intruder out. If the same password is used anywhere else, change it there too.
4. Check multi-factor sign-in (MFA). Look for sign-in methods you didn't add, such as an unfamiliar phone or app. Remove them. If MFA wasn't on for this account, turn it on now.
5. Check mailbox rules, forwarding and delegates. More on this below. It's one of the most common signs an account was taken over.
6. Check connected apps. Look for apps or add-ons recently given access to the account that nobody recognizes, and remove them. Access granted to an app can outlast a password change.
7. If money moved, call your bank. Don't wait for anything else on this list.

Why do mailbox rules matter?

Once someone has your password, a common next step is to quietly set up a rule. It might forward copies of your email to an outside address, or move any message containing words like "invoice" or "payment" into a folder you never open.

The rule keeps working after the password changes. It also hides the replies that would tip you off. That's why checking rules and forwarding settings belongs in the first hour, and why your IT provider will look at them again even if you already have.

What if a payment was redirected?

Picture a hypothetical: your controller receives an email that appears to come from a long-time vendor, announcing new bank details. The email looks right because it came from the vendor's real account, which had been taken over. A payment goes out to the new account.

If anything like that happens, call your bank's fraud line right away, using the number on the bank's website or your statement, never a number from the email. Tell them it's a fraudulent transfer and ask what they can do to stop or recall it. Speed matters more here than anywhere else in this article. In the US, this kind of fraud can also be reported to the FBI's Internet Crime Complaint Center at ic3.gov. Ask your bank how that fits with their process.

Going forward, the simplest protection is a habit: any change to payment details gets confirmed by phone, using a number you already had on file.

What if it wasn't email?

The same steps apply to other accounts. A fake recruiter link can lead to a taken-over social media or ad account. A text that appears to come from a staff member can ask for gift cards or a quick favor.

• Social and ad accounts: reset the password, remove any admins or users you don't recognize, check billing and payment methods, and contact the platform's support.
• Impersonation: confirm any unusual request through a channel you already trust, such as a phone call to a known number or a quick walk down the hall.

When should we call our IT provider?

As soon as the first steps are underway, and ideally alongside them. A good provider will review sign-in history, look for other affected accounts, check the device, block the sender and confirm whether anything else was touched. They should also save sign-in and audit logs early, because some are only kept for a limited time, and remove the phishing email from anyone else who received it.

For Simple IT clients, our help desk is open Monday through Friday, 8 AM to 8 PM Eastern, with a typical first response under an hour during business hours. After hours, call our emergency line at (317) 300-4606. You'll reach someone, or you can leave a voicemail and we'll respond within an hour.

Our role in an incident is to contain the problem, restore access and preserve evidence. If a deeper forensic investigation is needed, it typically runs through your insurer and attorney, and we work alongside them.

Do we need to tell our cyber insurance carrier?

If you have cyber insurance, contact your carrier or broker in the first hours, alongside your IT provider. Many policies spell out notification steps and timing, and many expect you to check with the carrier before hiring outside investigators or lawyers, or those costs may not be covered. Some carriers run a hotline that connects you with a lawyer who coordinates the response. Waiting until you know everything can work against you.

If client or employee data may have been exposed, call your attorney or the carrier's hotline early. An investigation directed by a lawyer is more likely to stay confidential, and they'll decide whether anyone needs to be formally notified.

What your policy means for your situation is a question for your insurance broker and your attorney, not your IT provider. The same goes for whether you have obligations to notify clients or anyone else. Our job is to give them clear facts and a timeline to work from.

Some businesses find out mid-incident that, without a plan of their own, the insurer's process becomes the plan by default. Reading your policy now, on a quiet day, makes that a much calmer experience. Our guide to what cyber insurance applications ask about your IT covers the IT side.

Why shouldn't we delete the phishing email?

It's evidence. Your IT provider, your bank and your insurer may all want to see it. Instead of cleaning up:

• Leave the phishing email where it is. IT will keep a copy as evidence, then remove it from everyone's inbox.
• Don't wipe or reinstall the device until IT has looked at it.
• Write down a simple timeline: what arrived, what was clicked, what was entered, and when. Stick to facts and times. Leave out guesses about the cause or what was taken; those conclusions belong to the investigation.
• Take screenshots of anything unusual, such as strange rules, unfamiliar sign-in alerts or messages you didn't send.

Should we warn staff and clients?

If the account sent messages you didn't write, yes. Tell your staff first, so nobody acts on a request from the compromised account. Then warn the outside contacts who received those messages, with a short note: don't act on the earlier message, and call us at a number you already have to confirm any request. Keep it to that. Don't speculate about what happened, who was at fault or what information was involved.

Send that warning from a channel you know is secure, or from the account itself once your IT provider confirms it's clean. If client data may have been exposed, talk with your attorney before you send anything beyond a simple warning.

The first 24 hours at a glance

When	What to do	Who
First hour	Report it, disconnect if needed, reset password, sign out sessions, check MFA, rules and connected apps	The person who clicked, with IT
Immediately, if money moved	Call the bank's fraud line	Finance lead
First hours, alongside IT	Notify your cyber insurance carrier or broker, before hiring outside firms	Owner or finance lead
Same day	IT reviews sign-ins, other accounts and the device	Your IT provider
Same day	Warn staff and any contacts who received messages	Owner or manager
Within the week	Review what happened and close the gap	Leadership, with IT

What happens after the first 24 hours?

Once things are steady, hold a short, blame-free review. How did the message get through? What would have caught it sooner? What one or two changes would make the biggest difference? Common answers include MFA on every account, a phone check for payment changes, better email filtering and brief, regular training. If data may have been involved, let your attorney decide how that review is run and written up.

If you'd like a broader starting point, our article on the security basics every 25-person company needs covers the essentials, and our cybersecurity service explains how we handle this for clients.

Where to start

The best time to plan for a phishing click is before one happens. Write a one-page list today: who to call at your IT provider, your bank's fraud line, your insurance carrier's contact, and who inside the company makes decisions. If you'd like help putting that plan together, book a 15-minute call.