Blog / how-to
What to Do After Clicking a Phishing Link
The order of operations after someone in your office clicks a phishing link and types a password: lock it down, find what the attacker left, then assess.
Someone in your office clicked the link, the page looked like the real sign-in page, and they typed their password. Maybe it was you. By the end of this post the account will be locked down, the attacker's footholds removed, and you'll have a short list of what to watch over the next week. This is written for the owner or office manager who is "IT" that day, not for a security team.
One note before we start: vendor menus move between releases, so treat the paths here as directions, not gospel. The concepts don't change even when the button does.
First, figure out what was actually given away
Not every click is a disaster. There are three levels, and the response is different for each.
Clicked the link but entered nothing: you're probably fine. Modern phishing is after credentials, not drive-by infections. Close the tab, report the email, move on. If the machine then did something strange (installer ran, browser extensions appeared), that's a malware question, which is a different procedure.
Typed a password: assume the attacker has it. This post is for you.
Typed a password and then approved a two-factor prompt, or entered a code on the fake page: assume the attacker has an active session right now. Same steps, but do them in the next few minutes, not after lunch.
The mistake I see most often is treating this as a virus problem. People run an antivirus scan for two hours while the attacker, who is in the cloud mailbox and not on the PC at all, quietly reads email and sets up forwarding. Deal with the account first. Scan later if you want.
Change the password and kill every session
A new password alone is not enough. The attacker may already be signed in, and existing sessions can survive a password change.
For Microsoft 365: if you have an admin account, reset the user's password from the admin centre, and use the option to sign the user out of all sessions (Microsoft calls this revoking sessions). Microsoft's own guidance adds a detail worth repeating: don't email the new password to the user, because you may be emailing it straight to the attacker. Phone them or walk over.
For Google: have the user change their password at myaccount.google.com, then go to Security, find Your devices, and choose Manage all devices. Sign out anything you don't recognize. If two sessions share a device name, sign out of both.
If the person reuses that password anywhere else, and most people do, change it there too. Today. Password reuse is how a $0 phishing email becomes a drained account somewhere unrelated.
Find what the attacker left behind
This is the step everyone skips, and it's the one that matters. An attacker who had even twenty minutes in a mailbox usually plants something that survives the password change.
Check inbox rules. Look for rules that forward mail to an outside address, or that delete or file replies containing words like "invoice", "payment" or "wire" so the real owner never sees the conversation. In Microsoft 365, rules can also be hidden from the normal settings page; an admin can list those with PowerShell, and if that sentence means nothing to you, it's a fair thing to hand off.
Check mail forwarding at the mailbox level, which is separate from rules. A single forwarding address is the cheapest persistence there is.
Check the two-factor settings for authentication methods that were added. Attackers register their own phone or authenticator app so they can walk back in through the front door later.
Check connected apps. Both platforms let third-party apps hold access to a mailbox independent of the password. Remove anything you can't name.
Look at what went out
Open the Sent folder and the Deleted folder and read the last few days with fresh eyes. If the account emailed clients, vendors or your bookkeeper during the window, call the people involved. A short, slightly embarrassing phone call now beats a vendor paying a fake invoice next week.
If anything financial moved, call your bank's fraud line immediately; speed genuinely changes the outcome. Report the incident to the Canadian Anti-Fraud Centre even if no money was lost. And if you carry cyber insurance, read the notification clause, because many policies require prompt reporting whether or not you intend to claim.
Test it
You're done when all of these are true: the password is new and unique, every session was signed out, no inbox rules or forwarding exist that you didn't create, two-factor is on and lists only the owner's devices, and connected apps are all accounted for. Then watch the sign-in activity page for a few days. One unfamiliar login from an odd location means you missed a foothold; start the list again.
Where this gets bigger than a blog post
This procedure covers one account that was phished once. It gets harder fast when the compromised account was an administrator, when the attacker had days rather than minutes, when money already moved, or when you can't tell how many accounts are affected. That becomes an investigation, and sign-in logs are where it lives.
The honest larger point: the cleanup is a one-time job, but noticing the next one early is not. Somebody has to be looking at sign-in activity and alert settings on an ordinary Tuesday, and that's a service, not a Saturday job. If you've just been through this and want a second set of eyes on whether the account is actually clean, that's exactly what a second opinion is for.