Someone clicked a phishing link. What now?

It happens. A good fake email looks like a parcel notice, an invoice or a message from Microsoft, and it only takes a busy moment to click. The click itself is rarely the end of the world. What matters is what happens next.

First, don't panic and don't hide it. The worst outcome is a member of staff who's too embarrassed to say anything. Make it easy for people to own up quickly. A quick "I think I clicked something" is worth far more than a perfect record.

If they typed in a password, change it straight away, from a different device if possible. If the same password is used anywhere else, change it there too. Turn on two-step sign-in (a code on their phone as well as the password) if it isn't on already.

If something downloaded or opened, unplug that computer from the network or turn off its Wi-Fi. Don't switch it off; leave it as it is so whoever looks at it can see what happened.

If they entered card or bank details, ring the bank using the number on the back of the card, not one from the email.

Check for signs it's been used. Look for emails in the Sent folder that nobody wrote, new rules forwarding mail elsewhere, or sign-in alerts from places you don't recognise. If you see any of these, get help.

Tell people. Let the rest of your team know what the email looked like so they can spot it. If it pretended to be a real company, you can report it to them. You can forward scam emails to [email protected], which is run by the National Cyber Security Centre.

Making it less likely next time

• Two-step sign-in on email and anything important. Even if a password leaks, it isn't enough on its own.
• A short talk with staff about what scam emails look like. Real examples from your own inbox work best.
• Website protection on your network that blocks many known scam sites before the page even loads.
• Backups you can trust, so if the worst happens, your files can be put back.
• A simple rule: if an email asks you to pay, log in or change bank details, check by phone first.

None of this needs to be expensive. Most of it is a setting or a habit.

How we can help

We set up website protection, two-step sign-in and backups for small businesses, and we provide short, plain-English staff guides. If you'd like a second pair of eyes after a scare, email [email protected].