Someone clicked a phishing link

Thank them for telling you: fast reporting is what limits the damage. Then find out exactly what happened, because the next steps depend on it.

Get help Bring in an expert now if

They entered an admin or finance account's password, or approved an MFA prompt they didn't start.
They opened a file and the device is acting oddly, or security software raised an alert.
The email asked to change bank details or pay an invoice, and money has already moved.

0 of 20 done

Ask what they did after clicking: just looked, typed a password, approved an MFA prompt, or downloaded or opened a file.
Each answer leads to different steps below. Ask calmly; people hide mistakes when they expect blame.
If they typed a password or approved an MFA prompt: change the password now, from a different, trusted device, and sign the account out of all sessions.
Changing the password alone doesn't end a session the attacker already has.
If they opened a file: disconnect that device from the network (unplug it, or turn off Wi-Fi), but leave it powered on.
Stops spread and data theft while keeping evidence in memory for an investigator.

Check the account's MFA methods and remove any that the person didn't add.
Attackers often register their own authenticator app to get back in after a password reset.
Look for new mail forwarding or inbox rules on the account, and remove any they didn't create.
Hidden rules that forward or delete mail are the most common way attackers stay in.
Check who else has access to the mailbox (delegates), and, if you're an admin, look for new organisation-wide mail flow rules.
Block the sender, the link's domain and any lookalike domains at your email filter and web filter or DNS.
Search all mailboxes for the same email (same sender, subject or link) and remove it.
Phishing rarely goes to one person. Others may not have reported it.

Check the link's reputation without opening it. Paste it defanged if you like.
Open the IOC lookup
Decode the link to see where it really leads, including redirects hidden in its parameters.
Open the URL decoder
Triage the whole email (its .eml file or source): who really sent it, whether SPF, DKIM and DMARC passed, where its links go and what its attachments are.
Open the phishing triage
Review the account's recent sign-ins for unfamiliar locations, devices or times, and check their IP addresses.
Open the IOC lookup
If a file was opened, run a full scan with your security software, or have the device checked before it reconnects.
If you can't be confident it's clean, reinstalling the device is safer than cleaning it.

If the password was reused anywhere else, change it there too.
Check the account's sent mail for phishing sent to colleagues or customers, and warn anyone who received it.
Report the phishing page to Google Safe Browsing and to the brand it imitated, so it gets taken down for everyone.

Write down what happened, when, and what you did. A short timeline is enough.
If the email imitated your own domain, check that SPF, DKIM and DMARC protect it, and watch for lookalike domains.
Open the domain checker
Tell the person who reported it what you found and what you did.
Quick feedback, not blame, is what keeps people reporting (NCSC).
Share a short, blame-free note with staff about this campaign and how to report the next one.

This checklist was checked against these public guides, which go into more depth. Bluebench isn't affiliated with them.

General guidance, not a substitute for your own incident response plan or professional help. Your ticks stay on this page only and aren't saved.