Match your situation
| What happened | Do this first |
|---|---|
| Clicked a link, nothing else | Report it; avoid the site; do not re-enter anything |
| Entered a password | Report it, then change that password everywhere it was reused |
| Read out or approved a one-time code | Report it as an account takeover attempt in progress |
| Entered card or bank details | Call your bank and finance team immediately |
| Installed an attachment or “update” | Report it; disconnect from Wi-Fi if the security team says so |
The first two minutes
- Stop using that computer for anything else — do not shut it down (evidence shuts down with it); just disconnect it from Wi-Fi if your security team tells you to
- Report it now, using your company’s report button or security contact — every minute counts
- If you entered a password: change it on that service first, starting from a different, trusted device
- If you approved a push notification or read out a one-time code: report that too — that is an account takeover attempt already in progress
If you entered payment details or approved a payment
Call your bank and your finance team immediately — payments can sometimes be recalled in the first hours, and only the bank can try. Then report internally: a payment scam almost always has a follow-up message ready, aimed at you or at a colleague with a similar role.
The password you reused
The risky version of this incident is not the password on one site — it is the same password on your email, your bank and your work account. Attackers try stolen passwords on other services automatically. Change the reused password everywhere, and turn on MFA where you can. This is exactly why password reuse is its own training topic.
Watch for the follow-up
A click is often only the first move. Expect a phone call from “IT support” offering to help you undo the damage, a message to your manager from “you”, or a second email referencing the first to look legitimate. Verify every follow-up through a channel you choose yourself — call the person back on the number you already have.
Report it even if you are worried about blame
Report it even if you are worried about blame: a click reported in the first minutes is far easier to contain than one found weeks later. If your workplace trains with our courses: the report method is on the end card of every video.
Common mistakes in the first hour
- Waiting to “see if something happens” — the attacker’s next step is usually within hours
- Shutting the computer down — it can destroy the evidence the response team needs
- Changing one password but not the reused copies
- Paying a small “fee” to make the problem go away — it marks you as a paying target
- Keeping it quiet from the team — colleagues are usually the next target of the same campaign
After the first hour
- Sign out of active sessions on the affected service (most accounts have a “sign out everywhere” option)
- Turn on MFA if it was not on yet, and prefer an app or passkey over SMS codes
- Watch the account: password-reset emails you did not request, new login alerts, unfamiliar rules in your mailbox
- Tell your manager in one line what happened and that it is reported — no long write-up needed at this stage
Work account or personal account?
If the password you entered was a work password, your security team can force a reset and watch for suspicious sign-ins — another reason to report first and not spend an hour quietly fixing it alone. If it was a personal account, the same steps apply, plus one more: check the recovery email and phone number on the account, because attackers change those first to keep access.
How our courses cover it
The phishing course “The Eid Voucher” (2055) ends with exactly this habit: report to the security team quickly, through the method on the end card. The ransomware course “Page After Page” (2042) shows the same minutes from the company’s side — how one fast report limits the damage, and why “fixing it yourself” makes things worse.