Clicked a phishing link? What to do next

It happens to everyone eventually. An email looks just right – a parcel delivery, a shared document, an invoice from a supplier – and you click before you've had time to think. The good news is that acting quickly makes a huge difference. Here's exactly what to do.

In the first few minutes

1. Stop and don't enter anything else. If a page is asking for your password, card details or to download something, close it.
2. If you downloaded or opened a file, disconnect the device from the network – unplug the cable or turn off WiFi – but don't switch it off. That stops anything spreading while it's checked.
3. Tell your IT support exactly what happened: which email, what you clicked and whether you typed anything in.

If you entered your password

Assume someone else now has it, and move fast.

1. Change the password immediately – ideally from a different, trusted device. If you use the same password anywhere else, change it there too.
2. Sign out of all sessions. Most services, including Microsoft 365 and Google, let you sign out everywhere at once.
3. Turn on multi-factor authentication (MFA) if it isn't already. It means a stolen password on its own isn't enough to get in.
4. Check your email for changes you didn't make – especially new forwarding rules or rules that move or delete messages. Criminals use these to watch your inbox quietly and hide replies.
5. Watch your sent items for messages you didn't send. A compromised mailbox is often used to phish your own contacts.

If you entered bank or card details

• Call your bank straight away using the number on the back of your card or on their website – or call 159, which connects you securely to most UK banks.
• Ask them to block the card or account and watch for unusual payments.
• If you've lost money, report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040 (England, Wales and Northern Ireland), or to Police Scotland on 101.

Report the email

Forward suspicious emails to the National Cyber Security Centre's reporting service at report@phishing.gov.uk, and scam texts to 7726. Reports help get fake sites taken down quickly. Then delete the message.

Extra steps for businesses

• Check whether personal data was exposed. If a breach is likely to put people at risk, UK GDPR requires you to report it to the Information Commissioner's Office within 72 hours of becoming aware of it.
• Warn your team – the same email has probably landed in other inboxes.
• Scan affected devices with up-to-date security software, and have your IT provider review sign-in activity.
• Learn from it, without blame. A team that reports quickly is your best defence.

How to make the next one less likely

No filter catches everything, so the aim is to make a single click much less damaging. MFA on every account, good email filtering, up-to-date devices, managed antivirus and short, regular reminders for staff on what to look out for will stop the vast majority of attacks in their tracks. That's the baseline we put in place for every client.