What to do if you clicked a phishing link

First: this happens to careful people every day, and reported-fast incidents

are almost always small ones. Work through these steps now.

The first ten minutes

1. Stop at the page. If a sign-in page opened, close it. If you're partway

through typing anything, stop.

1. If you entered your password — change it now, from another device or a

fresh browser tab, not from the page the link opened. If the same password

is used anywhere else, change it there too.

1. If you entered a code or approved a prompt, treat it the same as a

password: change the password and deny any new prompts (see KB-0007).

1. Report it immediately to your IT support team — say what you clicked,

when, and what you entered. Speed is what limits the damage; there is no

version of this where waiting helps.

1. Keep the email. Don't delete it — it's the evidence that lets the same

message be purged for everyone else.

1. Watch for follow-ups: unexpected sign-in prompts, password-reset

emails you didn't request, or odd sent messages from your account. Report

those too.

If you only clicked, and entered nothing

Lower risk, same report. Some links attempt silent downloads — if anything

downloaded or an installation prompt appeared, say so and leave the device

alone until IT has checked it.

Afterwards

When the dust settles, the checks in KB-0021 make the next one easier to

catch. No blame — the person who reports fast is the hero of this story.