Phishing email response: what to do if you get or click one

Check the email

1. Suspicious email arrivesEmployee

   For employees who get a suspicious email: what to check, how to report it, and what to do right away if you clicked, typed a password or paid.

   Don't click links, open attachments, reply or use unsubscribe links while you check.

2. Look for the warning signsEmployee

   Sender address that doesn't match the company, or a lookalike such as amazan.com. Hover over links to see the real address. Shortened links hide it.

   Urgency or threats, such as an account on hold. Requests for passwords, payment, gift cards or new bank details. Unexpected attachments. A generic greeting.

   Perfect spelling and grammar don't make it safe. Attackers use AI to write convincing messages.

3. Could it be phishing?Employee
   • Yes or not sure: go to step 4, Report it with the Report phishing button
   • Probably genuine: go to step 5, Check with the sender through a known contact
4. Report it with the Report phishing buttonEmployee

   Use the Report or Report phishing button in Outlook, Gmail or your mail app. No button? Forward it to the security team's reporting address.

   Outside work, forward scam emails to reportphishing@apwg.org (US) or report@phishing.gov.uk (UK).

   Then go to step 8, Did you click a link, open an attachment or reply?

5. Check with the sender through a known contactEmployee

   Use a phone number or website you already know, not details from the email. Never confirm by replying.

6. Did the sender confirm it's real?Employee
   • Yes: go to step 7, Genuine email. Carry on
   • No: go to step 4, Report it with the Report phishing button
7. Genuine email. Carry onEmployee
8. Did you click a link, open an attachment or reply?Employee
   • No: go to step 9, Reported. Delete it and stay alert
   • Yes: go to step 10, Tell security right away, even if you're unsure
9. Reported. Delete it and stay alertEmployee

   The report button usually removes the email. Watch for similar messages, and don't forward it to colleagues.

10. Tell security right away, even if you're unsureEmployee

    Say what you clicked, opened or typed, and when. Fast reports limit the damage, and good security teams don't blame people for reporting.

Act fast if you clicked

11. Did you open an attachment or install anything?Employee
    • Yes: go to step 12, Disconnect the device from the network
    • No: go to step 13, No file opened
12. Disconnect the device from the networkEmployee

    Unplug the network cable and turn off Wi-Fi. Don't try to clean it yourself unless security asks you to.

    Run a full antivirus scan only if security tells you to.

    Then go to step 14, Did you enter a password or a code on the page?

13. No file openedEmployee
14. Did you enter a password or a code on the page?Employee
    • Yes: go to step 15, Change that password now on another device
    • No: go to step 17, No password entered
15. Change that password now on another deviceEmployee

    Go to the real site by typing its address yourself, not through the email. Change any other account that uses the same password.

16. Sign out everywhere and check your MFA settingsEmployee

    Use the account's option to sign out all sessions. Check that no new MFA device or email forwarding rule was added. Turn on MFA if it was off.

    Then go to step 18, Did you send money, bank details or company data?

17. No password enteredEmployee
18. Did you send money, bank details or company data?Employee
    • Yes: go to step 19, Call finance and the bank immediately
    • No: go to step 20, No money or data sent
19. Call finance and the bank immediatelyEmployee

    Speed matters. Ask the bank whether the payment can be stopped or recalled. Use the number on your card or statement.

    If you sent card details, cancel the card. Report data you sent, such as customer records, to security and your privacy lead.

    Then go to step 21, Hand over to the security team

20. No money or data sentEmployee
21. Hand over to the security teamEmployee

Security triage

22. Review the reported emailSecurity

    Check the headers, links and attachments. Find everyone else who got the same email.

23. Remove the email from every mailbox and block the sender and linksSecurity

    Add the sender, domains and link addresses to your email and web filters.

24. Did anyone click, enter details or run a file?Security
    • No: go to step 25, Close the report and thank the reporter
    • Yes: go to step 26, Reset credentials and revoke sessions for affected accounts
25. Close the report and thank the reporterSecurity

    Quick feedback shows staff that reporting is worth it.

26. Reset credentials and revoke sessions for affected accountsSecurity

    Re-provision accounts that may be compromised. Audit account access afterwards to confirm the attacker no longer has it. Check for new MFA devices and mailbox rules.

27. Isolate and examine affected devicesSecurity

    Isolating the workstation stops malware spreading. Have the malware analyzed, remove it, then restore or rebuild the device and confirm it works.

28. Was money, personal data or a wider system affected?Security
    • Yes: go to step 29, Escalate to a full security incident
    • No: go to step 30, Contained. Close with lessons learned
29. Escalate to a full security incidentSecurity

    Bring in finance, legal and privacy. Personal data breaches may have legal reporting deadlines.

    US organizations can report to CISA at report@cisa.gov or the FBI's IC3. In the UK, report fraud to Report Fraud or Police Scotland.

30. Contained. Close with lessons learnedSecurity

    Share a short warning about this email with staff if others may get it.