An Employee Clicked a Phishing Link. What to Do in the First Hour

Short answer: Disconnect the computer from the network (unplug the cable or turn off Wi-Fi) but leave it powered on, then call your IT team right away. From a different, clean device, change the password of any account the employee entered on the fake page, sign that account out everywhere and check its MFA methods, inbox rules and forwarding. If money or payment details might be involved, call your bank immediately and file a report at ic3.gov. Speed matters more than having every answer.

Phishing links work because they look ordinary: a shared document, a shipping notice, a voicemail alert, an invoice. The employee who clicked isn't the problem. A quick, calm report is the best outcome you can get, so make it easy for people to speak up.

What happened when they clicked?

Not every click is a disaster. What matters is what came next:

• They clicked and closed the page. The risk is lower, but the page may have tried to download something. Have IT check the device.
• They entered a password. Assume the account is compromised. An attacker can use a stolen password right away.
• They approved an MFA prompt or entered an MFA code. Treat this as serious. Some phishing kits capture the code or the session itself, which can let an attacker in even with MFA turned on.
• They opened a download or attachment. Treat the computer as possibly infected.
• They entered payment, bank or card information. Call the bank or card company now.

Ask these questions without blame. You need accurate answers, fast.

What should you do in the first 15 minutes?

1. Disconnect, don't shut down. Unplug the network cable and turn off Wi-Fi on the affected computer. CISA's ransomware guidance says to isolate affected systems by taking them off the network, and to power devices down only if you can't disconnect them, because shutting down erases memory evidence an investigator may need.
2. Call IT by phone. Call your IT provider or help desk directly rather than emailing from the possibly compromised account. CISA recommends out-of-band communication, like a phone call, so attackers who are watching the mailbox aren't tipped off.
3. Write down what happened. The time of the click, the email it came from, what the page looked like and what was entered. Don't delete the phishing email; IT may need it.
4. Warn the team. The same message often goes to several people. A short heads-up keeps someone else from clicking.

How do you lock down the account?

If a password was entered, these steps follow Microsoft's guidance for responding to a compromised Microsoft 365 email account. Your IT team or Microsoft 365 administrator usually handles them, and Google Workspace has equivalent settings.

1. Disable the account or reset the password from a clean device. Microsoft's preferred first step is to temporarily disable the account. Otherwise, reset the password immediately using a computer that wasn't involved. Don't send the new password by email, since the attacker may still be reading the mailbox. If the same password was used anywhere else, change it there too.
2. Sign the account out everywhere. Changing a password doesn't always kick out a session the attacker already has. Revoking sessions invalidates existing sign-ins and refresh tokens.
3. Check MFA methods. Attackers often register their own phone or authenticator app. Remove any MFA method the employee doesn't recognize, and make sure MFA is enforced.
4. Check inbox rules and forwarding. This is the step people skip. Look for rules that forward mail outside the company, delete messages or move them to folders nobody checks, like RSS Subscriptions or Notes. Check mailbox-level forwarding settings too. Microsoft says to check hidden rules as well.
5. Check connected apps and admin roles. Remove any app the user didn't approve and any admin role they shouldn't have.
6. Review sign-in logs and sent mail. Look for sign-ins from unfamiliar locations and for messages the employee didn't send, especially to customers, vendors or your bookkeeper.

Could this turn into wire fraud?

This is where a phishing click becomes expensive. In business email compromise, attackers use a stolen mailbox, or one that looks almost identical, to send fake invoices, change vendor bank details or redirect payroll. The FBI's 2025 Internet Crime Report lists 24,768 business email compromise complaints and more than $3 billion in reported losses for the year.

In the first hour:

• Pause outgoing payments tied to that mailbox, including any vendor bank account changes received recently.
• If money has already gone out, call your bank immediately. The FBI says time is of the essence: ask the bank to recall the funds and ask what paperwork it needs.
• File a complaint at ic3.gov as soon as possible, regardless of the amount, with full transaction details. The FBI says IC3 may be able to help banks and law enforcement freeze funds. Its Recovery Asset Team reported freezing about $679 million in 2025, with a 58% success rate on the incidents it worked.
• Warn customers and vendors by phone if fraudulent emails went out from your account.

What comes after the first hour?

• Scan and check the computer. Your IT provider should scan it and decide whether to clean it or rebuild it before it goes back on the network.
• Look for related activity. Check whether other employees got the same email, clicked or entered credentials.
• Call your cyber insurer if you have a policy. Many policies have a breach hotline and specific notice requirements. Check your policy and talk to your agent.
• Get advice on notification duties. If customer, patient or employee data may have been exposed, talk to your attorney about any legal notice requirements.

How do you keep the next click from causing damage?

The goal isn't perfect employees. It's making one click survivable:

• MFA on every account, with phishing-resistant options for admins and email where possible. CISA recommends phishing-resistant MFA, particularly for email, VPNs and accounts that access critical systems.
• Email filtering that scans links and attachments and tags messages from outside the company.
• DMARC, SPF and DKIM on your domain so criminals have a harder time sending email that looks like it came from you.
• Alerts on new forwarding rules and risky sign-ins in Microsoft 365.
• A call-back rule for money. Any new or changed bank details get verified by phone at a known number, never from the email itself.
• Short, regular training and an easy "report phishing" button so people report fast.
• Backups that ransomware can't reach.

Quick reference: who to call

Situation	Call first	Then
Clicked, nothing entered	IT help desk	Report the email
Password entered	IT help desk	Reset, revoke sessions, check rules
File opened or downloaded	IT help desk	Keep the PC off the network
Payment or bank info involved	Your bank	IT help desk, then ic3.gov
Fake invoices sent from your account	IT help desk	Call affected customers and vendors

FAQ

Should we turn the computer off?

Not if you can disconnect it from the network instead. CISA advises isolating the device and powering it off only if you can't disconnect it, because shutting down can destroy useful evidence.

Is changing the password enough?

Usually not. Attackers may already have a signed-in session, a forwarding rule or their own MFA method on the account. Revoke sessions and check MFA methods and mailbox rules too.

Should we report a phishing click to the FBI?

If money was lost or a payment was redirected, yes. File at ic3.gov quickly and call your bank at the same time. For a click with no loss, report the email to your IT provider and your email platform.

Should the employee be disciplined?

That's your call, but punishing people for reporting tends to make the next person stay quiet. A fast report is what lets you stop the damage.

Have a plan before it happens

TechCore's help desk gives your team a place to call when something looks wrong, and our networking and security services cover the protections that keep a single click from spreading. If you're in the Nashville area, see our managed IT services in Nashville. Request a free IT assessment and we'll check your email security, MFA and backups before you need them.