What to do if you clicked a phishing email
The first ten minutes matter more than anything else. Here’s the order to do things in.
Do these now, in this order
- If you opened an attachment, ran a download, or aren’t sure what happened, disconnect the computer from the network. Unplug the cable or turn off Wi-Fi. If you only clicked a link and closed the page, skip to step two. Don’t shut it down; that can destroy evidence of what happened.
- Call your IT provider. Before you do anything else. If you’re a CK Technologies client, call 785-623-4841. Tell them exactly what you clicked and what you typed.
- If you entered a password, change it from a different device. Then change it anywhere else you used the same password. Turn on multi-factor authentication if it isn’t on.
- If you entered payment or bank details, call the bank. Right away, using the number on your card, not one from the email.
- Tell your coworkers. The same email probably went to the whole office. One person admitting it fast saves everyone else.
What not to do
- Don’t delete the email. Your IT provider needs it to see what it did and who else got it.
- Don’t reply to it or call a number in it.
- Don’t assume nothing happened because nothing looked different. Most of these attacks are quiet on purpose.
- Don’t be embarrassed. These emails fool experienced people every day. Hiding it is the only real mistake.
What your IT provider will do
They’ll check whether anything was installed, whether your email account is sending mail you didn’t write, whether a forwarding rule was added to your inbox, and whether the password you entered has been used from somewhere new. They’ll scan the computer, reset what needs resetting, and check whether anyone else clicked. If it was ransomware, they’ll isolate affected systems and restore from backup.
How to tell next time
- The sender’s address is close but not quite right, or the display name doesn’t match the address.
- It wants something urgent: pay now, verify now, your account will close.
- It asks you to sign in through a link. Even if the request might be real, don’t use the link; open the site or app yourself and sign in there.
- An invoice or payment-change request you weren’t expecting. Call the vendor on a number you already have.
- A message from the boss asking for gift cards or a wire transfer. Walk to their office or call them.
Scheduled security training and simulated phishing emails are part of our cybersecurity service. They work because staff get to practice on fakes before a real one arrives.
Sources
Common questions
I clicked the link but didn’t enter anything. Am I okay?
Probably, but not certainly. Some links install something just by opening. Disconnect and let your IT provider check the computer. It takes a few minutes.
Should we tell our customers?
If an attacker got into an email account, yes, and quickly, because the next step is usually fake invoices sent to your customers from your real address. Your IT provider can help you word it.
Does cyber insurance cover this?
Often, if you have a policy and the controls you said you had were in place. Report it to the insurer early; most policies require prompt notice.
Want a straight answer for your office?
A free 15-minute call with a technician in Hays. No pitch.
Related: Cybersecurity · Business IT support · Free IT security audit