Clicked a phishing link at work? What to do next (small business checklist)
Someone on your team clicked a link in an email that looked like it came from the bank, a delivery company or Microsoft. Maybe they also typed a password into the page that opened.
First: don't panic, and don't hide it. The sooner you act, the less damage a phishing email can do.
This guide follows the phishing advice from the UK's National Cyber Security Centre (NCSC) and turns it into steps for a small business.
In this article:
- what to do depending on what actually happened
- what to check in the email account afterwards
- a short checklist and a team rule you can copy
Step 1: Work out what happened
What to do depends on how far it went:
| What happened | Risk | Go to |
|---|---|---|
| Only opened the email, or clicked and closed the page without typing anything or downloading | Lower | Step 2 |
| Downloaded a file, opened an attachment, or installed something | Device may be infected | Step 3 |
| Typed a password into the page | Account may be taken over | Step 4 |
| Gave bank or card details, or sent a payment | Money at risk | Step 5 |
If someone isn't sure, assume the worse option.
Step 2: If nothing was entered or downloaded
The NCSC says that if you didn't enter personal information, download files or install software, further action is unlikely to be needed. Stay alert for unusual emails, login alerts or password reset messages over the next few days.
Still tell whoever looks after your IT (or the owner), so others can be warned about the same email.
Step 3: If a file was opened or something was installed
- Run a full scan with your antivirus software and let it remove what it finds (this is the NCSC's first step).
- If you have no antivirus, or the scan can't clean it, stop using the device for work until it has been checked or reset.
- On a work laptop or phone, contact your IT support and tell them exactly what happened.
Step 4: If a password was typed in
- Change that password now, from a device you trust, by typing the site address yourself (not from the email).
- Change it anywhere else the same password was used. The NCSC says to do this immediately.
- Sign out other sessions if the service offers it, and turn on two-factor authentication if it wasn't on.
- If it was an email account, check the things an attacker often changes (see below).
If you can't get into the account any more, follow the service's account recovery steps straight away.
Step 5: If bank or card details were given, or money was sent
- Contact your bank immediately. If you use online banking, you may be able to freeze or cancel cards there.
- If money was lost, report it to the police or your country's fraud reporting service as well as the bank.
Check the email account afterwards
When an email account has been taken over, attackers often quietly change settings so they keep access or can see replies. Check:
- Forwarding rules and filters: anything sending mail to an outside address, or moving messages to a folder you don't use
- Recovery email and phone number: still yours?
- Two-factor authentication methods: any phone or app you don't recognise?
- Recent sign-ins / devices: anything unfamiliar? Sign it out
- Sent mail: did the account send phishing emails to your customers? If so, warn them
Report it
- Tell your team about the email so nobody else clicks it.
- Report the email to your email provider (most have a "Report phishing" button).
- In the UK, the NCSC accepts suspicious emails through its reporting service, and suspicious texts can be forwarded to 7726. Other countries have their own reporting services.
Copyable checklist
- ☐ What happened? (opened / clicked / downloaded / typed password / paid)
- ☐ Told the owner or IT support, with the time and the email
- ☐ Antivirus full scan (if anything was downloaded or installed)
- ☐ Password changed, and anywhere it was reused
- ☐ Other sessions signed out, two-factor authentication on
- ☐ Email forwarding rules, recovery details and 2FA methods checked
- ☐ Bank contacted (if bank details or money were involved)
- ☐ Team warned, email reported
A team rule worth writing down
If you click something you shouldn't have, tell us straight away. Nobody gets in trouble for reporting.
People hide mistakes when they expect to be blamed, and a phishing click that is reported in five minutes is far cheaper than one found a month later.
Check for reused passwords
Step 4 is much easier if every account already has its own password. I made PassAudit, a checker that reads a password export (CSV) from your browser or password manager and lists reused, weak and similar passwords. It runs entirely in your browser, and passwords are not sent anywhere. Delete the exported file as soon as you are done.
You can open the trial from "Free tools you can use" below this article.
Summary
- Don't panic, and report it straight away
- Downloaded something: full antivirus scan, tell IT
- Typed a password: change it now, and anywhere it was reused; turn on 2FA
- Gave bank details or paid: call the bank immediately
- Check the email account's forwarding rules, recovery details and sign-ins
Source: NCSC: Phishing (respond and recover) · NCSC: Phishing scams, how to spot and report them
General information, not a substitute for professional incident response. This article was drafted with the help of AI and checked against the NCSC pages on 2026-10-21.