What to do if you clicked a phishing link
Clicking a link is not always a disaster. What happens next depends on whether you typed anything, downloaded anything, or allowed anything. Work through the branches below.
Reviewed by the ITRS security team · Last updated
Did you enter anything or download anything?
Be honest with yourself and your IT team. Nobody is helped by guessing, and the right response depends on exactly what happened.
| What happened | Risk | Go to |
|---|---|---|
Clicked, page loaded, closed it without typing anything | Usually low | 'If you only clicked' below |
Typed a password, MFA code or approved a sign-in prompt | High: assume the account is compromised | |
Downloaded or opened a file, or enabled macros/editing | High: the device may be infected | 'If a file was downloaded' below |
Clicked 'Accept' on a permissions screen for an app | High: an app may have access to your mail or files | Tell IT now; see 'What IT should check' |
Gave someone remote access | High |
If you only clicked
- Close the browser tab. Don't go back to the page to 'check'.
- Report the email using your mail system's Report button (in Outlook with Microsoft Defender for Office 365, 'Report > Phishing'), or forward it to IT as an attachment.
- Tell IT what time you clicked, from which device, and whether the page looked like a sign-in page.
- Watch for unusual MFA prompts over the next few days. Deny any you didn't start, and tell IT.
- Keep your browser and operating system up to date; drive-by exploits through a link alone are rare but they target unpatched software.
If a file was downloaded or opened
Disconnect the device
Turn off Wi-Fi or unplug the network cable. Leave the computer powered on so evidence isn't lost.
Don't try to clean it yourself
Don't run random removal tools, delete the file, or restart repeatedly. Note the file name and where it came from.
Call IT or your incident line immediately
Say a file from a suspicious email was opened. If you have endpoint protection (EDR), IT can isolate the device remotely and pull its timeline.
Change passwords from a different, clean device
Prioritize email, then banking and anything saved in the browser. Many infostealer infections take saved browser passwords and session cookies.
Wait for a decision on clean-up vs rebuild
If the file ran, a full rebuild is often safer than trying to clean the machine.
Report it internally and to the Cyber Centre
Internally, report every click, even ones that turned out harmless. Early reports let IT block the sender, search for the same message in other mailboxes and remove it before others click.
Externally, organizations can report cyber incidents to the Canadian Centre for Cyber Security at cyber.gc.ca/en/incident-management. Phishing that led to fraud can also be reported through reportcyberandfraud.canada.ca. Suspicious text messages can be forwarded to 7726 (SPAM), as Get Cyber Safe recommends.
What IT should check
- Find and purge the same message from all mailboxes, and block the sender and URL.
- Check the user's sign-in logs for unfamiliar locations, devices or new sessions after the click time.
- Review inbox rules, forwarding, delegates and recently added MFA methods.
- Review enterprise app consents granted by the user around the click time.
- On the device: EDR/antivirus history, browser downloads, new scheduled tasks, startup items and remote-access tools.
- Record the event and outcome, even if it was a false alarm. NIST SP 800-61 Rev. 3 treats these records as part of improving your detection over time.
When to call for help
Call the 24/7 incident line, (289) 582-9930, if a password or MFA code was entered, a file ran, money or banking details are involved, more than one person clicked, or you find inbox rules or sign-ins you can't explain. Those are signs the problem may already be bigger than one click.
A healthy security culture rewards fast reporting. The damage from phishing usually comes from the hours or days when nobody said anything.
Not necessarily. Credential-phishing pages don't install anything, and new malware isn't always detected. Report it anyway.
Related reading.
- PageUnder attack? Start hereIf something is wrong right now, this page tells you what to do in the next few minutes, what to avoid, and which step-by-step guide fits what you are seeing.
- ArticleHow to Stop Phishing Attacks: Email Security and Employee TrainingThe specific Microsoft 365 settings, sign-in rules and staff habits that stop most phishing at small and mid-sized businesses, and what to do when someone clicks anyway.
- GuideWhat to do if you entered your password on a fake login pageModern phishing kits steal your password, your MFA code and your signed-in session all at once. Resetting the password is necessary but not enough on its own.
- ServiceCybersecurity Services in Toronto: Managed Security for GTA BusinessesWe run the day-to-day security of GTA businesses: account and email protection, endpoint detection, firewall management, alert review and incident response, with a 24/7…
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.