If you are wondering what to do after clicking a phishing link at work, report it to your IT or security team right away, even if nothing unusual happened. Then pause further interaction with the message or site and follow your organization’s instructions. A quick, accurate report gives responders a chance to assess the exposure and decide what containment steps are appropriate.
The right response depends on what happened after the click. Opening a link is different from entering a password, downloading or running a file, approving an unexpected MFA request, or sharing sensitive information. Do not assume the incident is harmless, but do not try to investigate it yourself either.
In the first few minutes: stop and report
- Stop interacting with the page. Do not enter more information, click additional buttons, download anything else, or revisit the link to check whether it looks suspicious.
- Contact IT or security through an approved channel. Use your organization’s incident-reporting tool, help desk, security contact, or established escalation process. If you cannot access that channel, contact your manager and ask them to help reach the right team.
- Be direct about what you did. Say whether you only opened the link, entered credentials, downloaded or opened a file, approved an MFA request, or shared any work information. A clear report is more useful than trying to make the incident sound less serious.
- Follow instructions about the device and account. Do not shut down or restart the computer, run a cleanup tool, delete files, or disconnect from the network unless your organization’s policy or IT team directs you to do so.
Reporting immediately matters more than figuring out whether the link was truly malicious. The Microsoft phishing investigation playbook describes a structured response that includes investigating reported messages and taking response actions. Your organization’s own process determines who should act and how.
During the first 15 minutes: tell IT which situation applies
When you report the click, use the closest match below. If more than one applies, say so. The employee’s role is to report accurately and follow instructions; IT or security should decide on account containment, device isolation, evidence collection, and broader investigation.
If you only opened the link
Tell IT that you opened the page but did not enter information, download a file, or approve a prompt, if that is accurate. Close the page if it is still open, but do not return to it. Continue to follow your organization’s instructions, even if the page looked blank or nothing appeared to happen.
If you entered your work password
Tell IT immediately, including which account or service you used and whether you use the same password elsewhere. Do not enter the password into the suspicious page again. Contact IT before changing it so the response team can coordinate any password reset, session revocation, or additional account checks.
If IT cannot be reached promptly, use your organization’s established urgent escalation route. If the organization has a documented process for changing a potentially exposed password from a trusted device, follow that process. Do not use the potentially affected device to sign in to other services unless IT tells you it is safe.
If you downloaded or opened a file
Tell IT whether the file was only downloaded, opened, or otherwise run, and give its name if you can see it without opening it again. Do not delete it, move it, or try to scan or clean the device on your own. Avoid using the device for sensitive work until IT advises you. The response team can decide whether it needs to isolate the device or preserve it for investigation.
If you approved an unexpected MFA request
Report the approval and the account involved right away. If you receive more unexpected prompts, do not approve them. Tell IT whether you approved one or more requests and whether you entered a code or other authentication information.
If you shared sensitive business information
Describe what type of information you shared, where you entered or sent it, and whether it included customer, employee, financial, health, or other confidential data. Do not send the information again in a new message just to explain what happened. Ask IT or your manager how to provide any necessary details through an approved channel.
For the rest of the first hour: preserve useful details
Keep the original message if possible. Do not delete it or forward it to coworkers, since forwarding can spread a risky link and may make it harder for responders to examine the original. Use your organization’s report-phishing button or security process if one is available. Otherwise, ask IT how they want you to share the message.
Write down a short timeline while the details are fresh. Include the approximate time, the device you used, the sender and subject if visible, what you clicked, what happened next, and any information you entered or approved. If the link destination is already visible in the message or browser, report it as displayed, but do not click it again to confirm where it goes. Preserve any error messages or unusual behavior by describing them to IT; do not take extra investigative steps unless asked.
These details support incident handling and help responders understand what occurred. NIST’s Computer Security Incident Handling Guide discusses incident response as a coordinated process that includes reporting, analysis, and response. Your organization may have specific instructions for preserving messages and other evidence, so follow those rather than creating your own copies or changing files.
A short report template
You can adapt this message for your organization’s approved reporting channel:
“I clicked a suspicious link at approximately [time]. I was using [device]. The message appeared to come from [sender] and had the subject [subject]. After clicking, I [describe exactly what happened: only opened the page, entered a password, downloaded or opened a file, approved an MFA request, or shared information]. I have stopped interacting with it and have not deleted or forwarded the message. Please advise on next steps.”
If a detail is unknown, say that it is unknown. Do not delay the report while trying to fill in every blank.
What employees should not do
- Do not hide the click or wait to see if a problem appears.
- Do not send the suspicious link to coworkers as a warning. Alert them through an approved internal channel instead.
- Do not delete the message, clear browser history, remove downloaded files, or run cleanup tools unless IT directs you.
- Do not change passwords or disconnect a device on your own unless your organization’s process says to do so or IT instructs you.
- Do not assume that a lack of visible symptoms means there was no exposure.
These steps are not a substitute for your organization’s incident response procedures. A company may have additional internal reporting requirements, especially in regulated or public-sector environments. Follow your organization’s established process and let the appropriate team determine whether any further reporting is needed.
Frequently asked questions
Should I disconnect my work computer from the network?
Contact IT or security first and follow their instructions or your organization’s written procedure. Disconnecting may be appropriate in some situations, but the response team should decide when possible. Do not shut down or restart the computer unless directed.
Should I change my password before contacting IT?
Report the exposure first and ask for direction. IT may need to coordinate a reset or other account protections. If your organization has a documented urgent password-change process and you cannot reach IT, follow that process from a trusted device.
Should I report the click if nothing seemed to happen?
Yes. Report it even if the page appeared blank, you closed it quickly, or you did not enter information. IT can assess the message and tell you whether any follow-up is needed.
What should a manager do when an employee reports a click?
Thank them for reporting promptly, avoid blame, and help them reach IT or security through the approved escalation channel. Do not ask them to investigate the link or clean the device. Preserve the report details and follow the organization’s incident process.
Make the response process easier before an incident
A clear reporting path, employee guidance, and defined responsibilities can help teams respond without confusion. For related planning, see Zevonix’s guidance on cybersecurity consulting for business and its overview of what 24/7 IT support response time means.
The immediate next step after a suspicious work link is simple: report what happened, preserve the original message, and follow IT or security’s instructions. Zevonix provides free IT assessments and consultations for businesses that want to review their broader technology needs, including cybersecurity planning.