An Employee Clicked a Phishing Link. What Should You Do Next?

The employee told you they clicked. Your first response matters.

Thank them, then work quickly. A full, accurate account of what they did is what lets IT size the response, and someone who expects blame has less reason to give one.

If you only have two minutes:

1. Stop interacting with the page. Don't reopen the link, and don't delay reporting to collect screenshots. Note what appeared and keep the original email.
2. Contact IT by phone or another channel you already trust, not through the affected mailbox.
3. Ask what the employee did after the click: nothing, entered a password or code, approved a prompt, granted an app permission, downloaded a file, shared information or sent money.
4. Tell IT immediately if credentials, codes, sign-in approvals, application permissions or downloaded files were involved. If money was sent or banking details changed, contact finance and the bank immediately.
5. Write down times and who said what.

A click alone does not prove that your business has been breached. It does mean someone qualified should look.

First: don't just delete the email

Keep the original message. It holds the sender, the link and the headers IT can use to see who else received it and where the link leads. Deleting it does not necessarily destroy every copy, but it can make the work harder, so let IT decide how to remove it.

Ask the employee for a plain account of what they saw, typed, approved and did next. Skip "why did you click," because it gets you nothing IT can use. Don't wipe the device or improvise a cleanup either. Follow IT's instructions on isolation and evidence.

Was information entered?

The right response depends on what the employee did. You are not diagnosing the attack. You are giving IT an accurate account so they can respond in proportion.

If the employee is unsure, say so. IT can work from "I think I typed my password" better than from a confident guess.

Secure the account

IT should coordinate containment, because the right steps depend on what was exposed and covering each outcome matters more than following a fixed order.

Depending on the case, IT may temporarily block sign-in while they investigate. Microsoft's guidance for a compromised account includes disabling it during the investigation alongside other recovery measures. IT should also revoke sessions and check whether connected applications require separate action to remove access, because changing a password does not necessarily end a session that is already open. They will review the account's sign-in methods for anything the employee does not recognize and check which applications have been granted access.

One thing does not belong on that list: a new password emailed to the employee. If the mailbox may be compromised, the person you are trying to lock out can read it. Microsoft advises against emailing a new password to a potentially compromised account. Agree on a trusted channel in advance, such as a phone number or a chat tool outside the affected account, and use it for anything involving recovery credentials. Microsoft's guidance on responding to a compromised email account covers the technical side.

If only a link was clicked and nothing was entered, IT may reasonably decide an account reset is unnecessary. That decision should be theirs, and it should be recorded.

Check other sessions and devices

A single sign-in can leave traces in several places, and a downloaded file can mean a device problem as well as an account problem. These are separate questions. A clean antivirus scan on the laptop does not clear the cloud account, and a secured account does not clear a device that ran a file.

IT will look at where and when the account has signed in and whether a new device or sign-in method was registered. Unfamiliar locations need interpretation, since VPNs and mobile networks can produce misleading ones. If a file was run, IT may isolate the device until it is assessed. Ask the employee to list every device and browser where they are signed in to work accounts, including a personal phone.

Who needs to know?

Start with the employee's manager and IT, then widen the circle only as far as the facts require.

• Finance and the bank, immediately, if money was sent or payment details were changed. A recent transfer can sometimes be acted on, and the window is short.
• The person responsible for protecting personal information, if customer or employee information may have been exposed.
• Your insurer or broker, if your policy requires notice. Check the policy wording for who to call and when, and follow its instructions about engaging outside help.
• Customers or suppliers, if the account sent malicious messages. Coordinate warnings through trusted channels, not from the affected account.

In Quebec, a confidentiality incident involving personal information has two separate consequences. Every such incident belongs in the business's incident register, including minor ones. Notifying the Commission d'accès à l'information and the affected people is required when the incident presents a risk of serious injury. By default, the person with the highest authority in the business holds this responsibility, unless the function has been delegated in writing, and the business remains responsible for meeting its obligations. A suspicious click alone does not establish a reportable incident. IT's findings help the responsible person assess whether personal information was affected and whether the threshold is met.

What IT should investigate

The question here is what actually happened and who or what was affected. It reaches beyond the mailbox, because a compromised Microsoft 365 identity can expose the associated mailbox, SharePoint and OneDrive.

IT will typically look at:

• Mailbox rules, forwarding addresses and sent items the employee did not create.
• Who else received the same message and whether anyone else clicked. If related messages are found, IT can remove them and contain the wider campaign, after preserving what evidence is needed.
• Cloud files that were opened, downloaded or shared, and any new external sharing links.
• Messages sent from the account to colleagues, customers or suppliers while access may have been unauthorized.
• Financial consequences: changed payment instructions, invoices sent in the employee's name and transfers already made.

Some of these answers depend on logs, and logs have limits. Retention periods, licence levels and the settings in place before the incident all affect what can be established.

When the incident is actually over

An incident is over when four things are true. "We changed the password" is only the start of the second.

1. Findings are documented. What happened, what was affected and how IT concluded it, including anything the available evidence could not settle.
2. Containment and recovery are complete. Unauthorized access is closed, changes the attacker made are reversed, and affected systems and data are restored.
3. Reporting obligations are assessed. Finance, the bank, the privacy officer, your insurer and, where applicable, the Quebec register and notification question have each been considered, with the decision recorded.
4. Follow-up monitoring is assigned. A named person watches the account and related activity until a set review date, because remaining uncertainty is a reason to keep looking.

What to change afterward

Hold a review that focuses on what happened and what would prevent a repeat. Include the employee without turning the discussion into blame.

• Make reporting easy. A report button or one shared address, and a reply that says thanks.
• Strengthen sign-in. Use phishing-resistant authentication where it is supported. Our article on Microsoft's move to passkeys explains what is changing and when.
• Improve email and device protection. Ask IT whether filtering and device safeguards could have stopped this message or limited the click.
• Verify payment changes. Call a known number before acting on new bank details.
• Write a one-page response plan. Who to call, the trusted channel, the questions to ask, and who handles finance and privacy. If your insurer expects an incident process, our article on preparing for the cyber insurance questionnaire shows what they tend to ask.

Here is a checklist you can copy into that plan.

If a click has already happened and you want help assessing and responding, contact Syslogic.