What Should You Do After Clicking a Phishing Link? A First-Hour Checklist

If you clicked a phishing link, stop interacting with the page, disconnect the affected device from networks if anything downloaded or ran, contact your workplace security team if the device or account is work-related, and change any password you entered—from a separate, trusted device. Then revoke sessions, enable strong multi-factor authentication, scan or reimage the device as appropriate, preserve the message, and report it.

Clicking is not the same as being compromised. The response depends on what happened next. A page that merely loaded creates a different risk from entering a password, approving an MFA prompt, downloading a file, granting an app access, or running software.

First, classify what happened

Ask these questions without revisiting the link:

• Did the page only open?
• Did you type a username, password, recovery code, card number, or personal information?
• Did you approve a push notification, passkey prompt, QR-code login, or permission request?
• Did a file download, and did you open or run it?
• Did you install a browser extension, mobile profile, application, or certificate?
• Is this a work device or account?

Write down the approximate time, device, browser, account, and actions. This small timeline helps responders search logs and invalidate the right credentials.

The first 10 minutes

1. Stop and close the page

Do not enter more information, call a number shown on the page, click “unsubscribe,” or follow its cleanup instructions. A convincing recovery message can be part of the same scam.

2. Isolate the device when code may have run

If you opened an attachment, ran a program, installed something, or the device behaves unusually, disconnect Wi-Fi and unplug Ethernet. In a company, contact the security or IT team immediately and follow its procedure. Do not wipe the device before responders decide whether evidence is needed.

If the page simply loaded and nothing was downloaded or installed, full isolation is often unnecessary. Modern browsers sandbox web content, but browser vulnerabilities do exist; update the browser and operating system and continue the checks below.

3. Use a known-good device for account recovery

Open the real service by using a saved bookmark, its official app, or typing the known address yourself. Do not use links or phone numbers from the suspicious message.

If you entered a password, change it immediately. If that password was reused, change it everywhere it was used, starting with email, the password manager, financial services, and identity-provider accounts. A password manager makes unique replacements much easier.

The next 30 minutes

Revoke sessions—not just the password

Changing a password may not terminate every existing session. Look for “devices,” “sessions,” “where you’re signed in,” connected apps, app passwords, API tokens, and forwarding rules. Sign out unfamiliar sessions and, when available, choose “sign out everywhere.”

Email deserves special attention. Attackers commonly add forwarding rules, change recovery details, register new MFA methods, or create application passwords so access survives a password reset.

Reset multi-factor authentication when necessary

If you disclosed a one-time code, approved an unexpected prompt, scanned a login QR code, or enrolled a new authenticator, review and reset authentication methods. Prefer phishing-resistant passkeys or hardware security keys when the service offers them.

Remove suspicious authorization

A fake “document” may request OAuth access rather than a password. Review third-party applications with access to mail, files, contacts, calendars, or cloud storage. Revoke anything you do not recognize. Authorization grants can remain valid after a password change.

Protect financial and identity data

If you entered payment details, contact the card issuer through the number on the card or its official app. If you disclosed sensitive identity information, follow the identity-theft process for your country. Watch statements and account notifications; do not rely only on a later antivirus scan.

Check the device safely

Update the operating system, browser, security software, and extensions. Run the platform’s trusted security scan. Review recent downloads, installed applications, browser extensions, notification permissions, and configuration profiles.

For a work endpoint or a device on which untrusted software ran, a professional investigation or managed reimage may be more reliable than trying to “clean” it manually. Antivirus can find known malware; it cannot prove that every persistence mechanism is gone.

Warning signs include new extensions, disabled security controls, unfamiliar login alerts, pop-ups outside the browser, new administrator accounts, unusual battery or network use, and messages sent from your account.

Preserve and report the evidence

Keep the original email or message, sender information, URL, attachment name, and screenshots. Do not forward a potentially malicious attachment casually. Use the service’s phishing-report button or your company’s reporting channel.

CISA’s public guidance summarizes prevention as “recognize, report, delete” and recommends contacting an organization through independently found details rather than information inside the suspicious message.^[1] In the United States, consumer scams can also be reported to the FTC.^[2]

What not to do

• Do not keep testing the link.
• Do not pay someone who contacts you claiming they can recover the account.
• Do not use the affected device to reset the most sensitive accounts if malware may be present.
• Do not assume a password change removes malicious forwarding rules, sessions, or app grants.
• Do not conceal a workplace incident. Minutes matter more than embarrassment.

A compact response checklist

1. Stop interacting and record what happened.
2. Isolate the device if a file ran, software was installed, or behavior changed.
3. Notify workplace security immediately when relevant.
4. From a trusted device, change every exposed or reused password.
5. Revoke sessions, tokens, app passwords, and suspicious connected apps.
6. Review MFA methods, recovery details, mail rules, and account activity.
7. Update and scan the device; obtain professional help when code executed.
8. Contact financial providers if payment data was exposed.
9. Preserve and report the message.
10. Monitor accounts and alerts for follow-on activity.

The bottom line

The best response is calm and specific. Determine what you gave the attacker—attention, credentials, authorization, data, or code execution—and remove that access. Treat email and recovery accounts as the highest priority, because control of them can unlock everything else.

Sources