Clicked a phishing email at work? Report it to your IT team or security contact immediately — within minutes, not hours — then act on what you handed over: change the password from a different device if you entered credentials, alert your bank if you entered card or account details, and disconnect from the network if you opened an attachment. Speed matters more than embarrassment. Most of the damage from a phishing click happens in the first hour, and a fast report is what stops it.
TL;DR
- Report the click to IT before anything else — and do not delete the email.
- If you entered a password, change it immediately from a different device, and anywhere you reused it.
- If you entered bank or card details, call your bank's fraud line and tell finance so they can verify pending payments.
- If you opened an attachment or downloaded a file, disconnect the device from Wi-Fi and follow IT's instructions.
- Nobody should get fired for reporting fast — the reporting is the win, not the click.
Why the first hour matters
Phishing is not mostly about technical wizardry — it is about what an attacker does with access. The breach data makes the stakes plain: roughly 60% of data breaches involve a human element — an error, a clicked link or a manipulated employee (Verizon, 2025 DBIR). And when cybercrime costs an Australian small business money, it costs real money: an average self-reported loss of $56,571 per incident, up 14% year on year (ASD, Annual Cyber Threat Report 2024-25).
An attacker who captures a working email password does not announce themselves. They read quietly, learn how your business pays invoices, then either launch payment fraud from the compromised mailbox or sell the access. One of the first things they do is set up a forwarding rule that hides their replies — so every hour the mailbox stays compromised is an hour of setup you cannot undo later.
Step by step: the first five minutes
- Report it. Use the report button in your email client if there is one, or contact IT directly. Say exactly what you clicked and what you typed.
- Do not delete the email. IT needs the sender and the link to block the domain for everyone else and check who else received it.
- Do not "test the link again" to see if the site is still up. That doubles your exposure and helps nobody.
- If you entered a password: change it now, from a different device if possible, and change it anywhere else you reused it.
- If you entered bank or card details: call your bank's fraud line and tell your finance team so they can freeze or verify any pending payment changes.
- If you opened an attachment or downloaded a file: disconnect the device from Wi-Fi (or unplug the network cable) and wait for IT. Do not keep using it.
What IT will do — and why they ask strange questions
Expect IT to ask for the exact sender address, the time you clicked, whether you entered credentials, and whether you replied. They are not interrogating you; each answer changes the response:
- Clicked only. They check whether the link delivered anything, block the domain, and move on.
- Entered credentials. They force a password reset, revoke active sign-in sessions, check mailbox rules for hidden forwarding, and review sign-in logs for unexpected locations.
- Entered payment details. Finance joins the response: any recent or pending supplier bank-detail change gets verified by phone, using a number you already have — never one from the suspicious email.
- Opened an attachment. The device gets scanned or reimaged, and IT watches for unusual traffic from it.
What not to do
- Do not hide it. The most expensive phrase in security is "I thought someone else would report it."
- Do not change the password on the compromised device itself. If the device carries malware, the new password may be captured too.
- Do not forward the email to colleagues as a warning. One more click in the wild is how a single victim becomes ten. Report it and let IT warn everyone.
- Do not run your own clean-up tools. Installing random antivirus software on a possibly-infected work device makes IT's diagnosis harder, not easier.
Reporting after hours and from home
Phishing does not keep office hours, and neither should reporting. If you click outside work hours, send the report anyway — even a one-line message to the IT inbox with the sender address and what you entered is enough to start the response. Remote and hybrid staff should know the out-of-hours reporting path before they need it; if you are not sure yours exists, ask, because that question is cheaper than an unreported compromise over a weekend.
If you are the person who always clicks
A click is a skills gap, not a character flaw — but a repeated pattern is worth fixing deliberately. Take the short refresher attached to each simulation result rather than skimming it; the tactics that catch you — urgent payment requests, payroll changes, courier notices — are the ones targeting your real inbox. Most awareness platforms, including Cyber Aware's phishing simulations, auto-enrol clickers in a five-minute lesson on the exact lure they fell for, and human risk reporting lets managers spot repeat patterns and offer coaching without public shaming.
How to make reporting the norm in your team
The best outcome from any click is a fast report, and fast reporting is a culture, not a policy:
- Praise the reporter, not just the catch. A public thank-you for a report — even one that turns out harmless — trains the habit faster than any training module.
- Never tie clicks to discipline. Teams that punish clicks learn to hide them; the click rate stays the same and the detection rate collapses. If your organisation is weighing consequences for simulation results, read the evidence on whether simulation results justify disciplinary action first.
- Practise on simulations. Monthly phishing simulations paired with security awareness training give every employee a safe rehearsal of exactly this playbook — so the first time they follow it is never during a real attack.
FAQ
Should I report a phishing email I only opened but didn't click? Yes. IT can block the sender before a colleague clicks, and opened-but-unreported emails hide whole campaigns.
I clicked and entered my work password, but nothing seems to have happened. Do I still need to tell IT? Yes. Attackers often wait days or weeks before using stolen credentials, and "nothing happened" is exactly how a compromise sits undetected.
Who pays if money was stolen after a phishing click? It depends on the bank, the payment type and how fast you reported. Calling your bank within hours dramatically improves recovery odds — another reason speed beats embarrassment.
Will I get in trouble for clicking? At organisations with a healthy reporting culture, no. Punishing clicks is a documented failure mode: it reduces reporting, not clicking.
How do I report if I'm not sure it was phishing? Report it anyway. Sorting real threats from false alarms is IT's job, and they would rather check ten harmless emails than miss one real one.