You clicked a link in an email and something felt wrong the moment the page loaded. What you do in the next ten minutes matters far more than the click itself. This is the exact order of steps to follow in 2026 — for yourself or for an employee who just raised their hand — and it ends with the follow-up that turns one mistake into a team-wide upgrade.
TL;DR
- Step one: disconnect the device from the network, but leave it powered on — evidence and running malware both matter.
- If you entered credentials anywhere, change that password immediately from a different, trusted device, then anywhere it was reused.
- Check whether multi-factor codes, approvals or emails were sent in the window after the click — attackers use your session, not just your password.
- Reset other sessions by changing the email account password first; it is the key to every other reset email.
- Report the click internally and to ReportCyber — reporting speed, not click speed, determines how cheap the incident stays.
First, the mindset: the click is a starting pistol, not a verdict
Roughly 60% of breaches involve a human element — a click, an error, or a person talked into an action — according to Verizon's 2025 Data Breach Investigations Report. That statistic terrifies people into hiding clicks. Resist that. A click only becomes an incident when it is followed by entered credentials, an opened attachment, an approved MFA prompt, or data typed into a fake portal. Most clicks result in none of those, and the response below takes minutes.
The Australian Signals Directorate received more than 84,700 cybercrime reports in FY2024-25 — about one every six minutes — and the average self-reported cost for a small business hit $56,600 (ASD Annual Cyber Threat Report 2024-25). The businesses on the cheap end of that distribution are the ones that reacted in minutes.
The first ten minutes
1. Stop and disconnect — but do not power off
Close the browser tab. Then disconnect the device from Wi-Fi and unplug any network cable. Leave the machine running: shutting down can destroy volatile evidence your IT person or provider will want, and modern malware does not need the tab open to continue working. If you are unsure whether something was installed, this is a job for whoever manages your devices — say the words "I clicked a link, please check this machine before I use it for work again."
2. Inventory what you actually did
The response branches on this single question: what did I give them?
- Nothing — I clicked and closed the page. Your risk is mostly malware from the visit. Run a device scan, keep an eye on odd behaviour, and move to step 6.
- I entered a username and password. Treat those credentials as stolen. Move to step 3 immediately.
- I entered payment or bank details. Call your bank's fraud line now, before anything else — minutes decide whether a transfer can be recalled. Then continue with the other steps.
- I opened or downloaded an attachment. Do not open it again. Tell your IT provider; the file may need detonating in a safe environment.
- I entered a one-time code or approved an MFA prompt. An attacker has live access right now. Skip straight to step 3 and assume they are inside.
3. Change the password — from a different device
If credentials were entered, change that account's password immediately, from a different device than the one that was compromised. If the account supports it, sign out of all other sessions at the same time (Microsoft 365 and Google Workspace both have a one-click "sign out everywhere" option in account security settings). Then change the password anywhere else that password was reused — password reuse is how one click becomes five compromised accounts.
4. Reset your email last-in, first-out
Your email account is the master key: whoever controls it can reset everything else and read every reset email. That is why its password change is the priority, and why you should then check it for damage:
- Review sign-in activity for logins you do not recognise.
- Check mailbox rules and forwarding — attackers add a rule that deletes or hides messages from the bank, from IT, or containing the word "password".
- Check the recovery email and phone number have not been changed.
- Check the Sent folder. Attackers frequently email every contact from a fresh compromise with another lure in your voice.
5. Hunt for follow-on damage in the first hour
- MFA prompts: reject any approval request you did not trigger, and tell IT if you received them.
- New inbox rules: remove any you did not create.
- Payment platforms and payroll: check for changed bank details or new payees.
- Check whether your email address appears in known breaches using Have I Been Pwned — it tells you which incidents exposed your address, which helps you judge which lures are likely to target you next.
Report it — internally and to the authorities
Tell your manager or IT provider the same hour, in plain terms: what the email said, what you clicked, what you entered. Speed of reporting is what keeps an incident small, and a report that saves even one colleague from the same lure pays for the embarrassment many times over.
In Australia, cybercrime incidents go to ReportCyber, and scam attempts can also be reported to Scamwatch. Reporting feeds the national picture — the ASD statistics above come from reports — and it creates the paper trail your insurer will ask for. If your business falls under the Privacy Act 1988 and personal information was exposed, the OAIC's Notifiable Data Breaches scheme sets out when you must notify affected individuals and the regulator.
What happens next (and what should)
After the immediate response, the gap to close is structural: the click proved a specific tactic works against your team. A monthly phishing simulation programme converts that from a one-off scare into measured improvement — anyone who clicks a simulation is auto-enrolled in a short course on exactly that tactic the same week. Human risk reporting then shows whether clicks and repeat clickers trend down month over month, instead of leaving you to guess.
If your business has never measured where its weaknesses are, a security gap assessment puts the human layer alongside MFA, backups and patching on one scored list, so the next dollar of security spend goes where the evidence says.
FAQ
I clicked but entered nothing. Am I safe? Mostly, yes — the click alone exposes you to drive-by malware, which modern browsers block most of. Run a device scan, watch for odd behaviour for a few days, and report it anyway so the tactic gets added to your team's training.
I entered my password on a fake login page. What now? Change that password immediately from a different device, sign out all other sessions, check inbox rules and recovery details, and repeat the password anywhere it was reused. Do this before anything else — the account may be in active use by the attacker.
Should I shut down my computer? No. Disconnect from the network but leave it on. Shutting down destroys evidence and some malware resumes worse after a restart.
Do I have to tell my employer? Yes — and a good employer makes that easy. A hidden click that becomes a breach costs vastly more than a reported one; most awareness programmes explicitly promise no consequences for a reported click, because punishing reporters guarantees the next real attack goes unreported.
How do I know if my account was actually used? Check the account's sign-in activity for unfamiliar locations and devices, the Sent folder for messages you did not write, and inbox rules you did not create. Those three checks catch the large majority of account misuse.
One last thing
Print the five branches in step 2 and put them next to the kettle: nothing entered, password entered, bank details entered, attachment opened, code entered. The teams that lose the least to phishing are not the ones that never click — they are the ones where everyone knows what the click starts.
Related guides
- Phishing simulations — measure how often the click happens before a real attack makes it count.
- Security awareness training — the monthly cadence that turns incident response into a trained reflex.
- The 2026 MSP buyer's guide — compare platforms on auto-remediation and reporting.