What to do if an employee clicked a phishing link

Sooner or later someone will click a phishing link — it happens even in the most careful teams. What matters most is not the click itself, but what happens in the next minutes and hours. A fast, calm response often stops the damage entirely. Here is what the employee and the business should do.

What the employee should do immediately

If you clicked the link but entered nothing, the risk is often small. If you entered login details or downloaded a file — act without delay.

• Stop filling in any forms and close the page.
• Disconnect the device from the internet if you downloaded or ran a suspicious file.
• Report to IT or your manager immediately — the sooner, the smaller the damage.
• If you entered a password, change it from another, trusted device.
• Do not delete the email — it may be needed for the investigation.

Most important: report immediately, even if it is embarrassing. A hidden incident is the most dangerous — an attacker only needs time, and silence gives it to them.

If you entered login details

• Change that account’s password, and if the same password was used elsewhere — change it there too.
• Enable two-factor authentication (2FA) if it is not already on.
• Review the account’s active sessions and disconnect any unfamiliar ones.
• Watch the account for unusual activity over the coming days.
• If you entered card details — call the bank and block the card.

What the business (IT or manager) should do

• Immediately determine the scope: what the employee clicked, what they entered, which account is affected.
• Force-disconnect the affected account’s sessions and change passwords.
• Check whether emails were sent from that account to others — attacks spread internally.
• Warn the rest of the team not to open similar emails.
• If finance or data are affected, decide about informing the bank and responsible authorities.

What NOT to do

• Do not punish or shame the employee — otherwise others will hide their mistakes.
• Do not ignore it with "nothing happened" — sometimes damage appears days later.
• Do not forward the phishing email to colleagues without warning that it is dangerous.
• Do not rush to delete evidence before the incident is assessed.

How to turn an incident into a lesson

Every click is a chance to strengthen the team. After an incident, briefly review which signs in the email were missed and assign relevant training. This is exactly why effective security programmes respond to a click with training, not punishment. Opsinel automates this: when an employee clicks a simulation link, a short lesson appears immediately — so a real mistake becomes a skill before a genuine attack.