Phishing basics
What should you do if you clicked a phishing link?
Updated
Short answer
If you clicked a phishing link at work, tell your IT team or managed service provider right away and keep the email. If you typed a password, change it and turn on or reset multi-factor authentication. If you downloaded something, run a security scan. Contact your bank if you shared payment details. Reporting quickly matters far more than the click itself.
First, don't panic: what happens when you click?
Clicking a link does not always mean damage was done. Often the risk comes from what happens next: typing your password into a fake sign-in page, entering card details, or opening a file the page downloads.
The Canadian Centre for Cyber Security says a quick and coordinated response is essential. The goal is to give the people who look after your systems a head start, so act calmly and soon rather than hoping it was nothing.
What should you do in the first few minutes?
Work through these steps in order. If you are not sure whether a step applies, ask your IT contact rather than guessing.
- Stop. Close the page and do not enter anything else into it.
- Do not reply to the sender or click anything else in the message.
- Keep the email. Do not delete it, because IT may need it to check who else received it.
- Tell your IT team or managed service provider right away, by phone or in person if you can. Say what you clicked, when, and whether you typed anything.
- If you opened an attachment or something downloaded, follow IT's instructions. They may ask you to disconnect the computer from Wi-Fi or the network while they check it.
Did you enter a password? Change it now
If you typed your work password into the page, assume someone else now has it. The Cyber Centre advises changing passwords on any accounts that may be compromised and turning on or resetting multi-factor authentication (MFA).
Change it from a device you trust. If your computer might be infected, use a different one, or let IT reset it for you. Go to the real sign-in page by typing the address yourself, never through a link in the email.
CISA adds that if you used the same password anywhere else, change it on each of those accounts too, and do not use it again.
Did something download or open?
The Cyber Centre and the FTC both recommend running a security scan if you clicked a link or opened an attachment, and removing anything it flags. On a work computer, let IT run or confirm that scan, since they may have tools that see more than the built-in antivirus.
Keep an eye out for anything unusual in the days after: new sign-in alerts, emails in your sent folder you did not write, rules in your mailbox you did not create, or colleagues asking about messages you never sent.
Why report it, even if you feel embarrassed?
Phishing emails are written by people whose job is to fool busy staff, and anyone can be caught. What matters is how fast the right people find out. An early report lets IT reset accounts, block the sender and warn colleagues before anyone else clicks.
Staying quiet is what turns a click into a real incident. A good workplace thanks people for reporting, and many businesses run practice phishing emails so that reporting becomes a habit rather than a source of shame.
Some small businesses use a training platform such as NetMinder, which their MSP runs under its own brand, to send monthly practice phishing emails and show a two minute lesson to anyone who clicks one. If you clicked a practice email, that lesson is the whole point, and nothing was put at risk.
Where else can you report a phishing email?
At work, your IT team comes first. Outside work, or once IT has what it needs, these official channels take reports.
- Canada: the Canadian Anti-Fraud Centre at 1-888-495-8501, and your local police if you lost money
- United States: ReportFraud.ftc.gov, and forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org
- United States: if your personal information was taken, IdentityTheft.gov has steps based on what was lost