In this guide 6 sections
Stay calm and move in order. Disconnect the laptop from the network. Reset the password and sign the user out everywhere. Check the mailbox for forwarding rules. Warn the accounts desk about odd payment requests. Write down what happened. Do not delete the email yet.
First ten minutes: isolate and ask three questions
Thank the person for telling you, and mean it. Blame makes the next person stay quiet. Delay is what hurts. Ask them to unplug the network cable or switch off wifi, but leave the laptop powered on and do not delete the email, since the headers help later.
Then ask three things. Did the link open a page asking for a password? Did they type one in? Did a file download and run? The answers decide how far to go, and a vague answer should be treated as the worst one until proven otherwise.
- Page opened and closed, nothing typed: lower risk
- Password or code typed into the page: treat the account as taken
- A file was downloaded and opened: treat the laptop as infected
- Email forwarded to colleagues: find every recipient
Reset the password and end every session
If anything was typed, change the password from a different, clean device. Changing it on the affected laptop helps nobody. A keylogger may be recording the new one. Then sign the user out of every session, and revoke the refresh tokens in the mail admin console so that phones and browsers must sign in again.
Check that multi-factor sign-in is on and that every registered phone belongs to the staff member. Attackers sometimes add their own device or authenticator app once inside. Remove strangers. Remove anything the user does not recognise.
Did the person use that password anywhere else? Change it there too, starting with the bank portal and the cloud accounting login. Reuse is how one click becomes three problems. A single stolen password can open the shared drive, the accounting login and the supplier portal in one afternoon.
Look for what the attacker set up
The quiet damage is usually inside the mailbox. Open the rules and forwarding settings. A rule that moves mail containing the word invoice or bank to a hidden folder is the classic sign of an attacker settling in. So is one that copies mail to an outside address.
Read the sent items and the deleted items for the last day. Look for messages the user did not write. Check recent sign-ins for places or devices that do not fit. Then see whether a new app gained mailbox access through a consent screen the user clicked past.
- Inbox rules and forwarding addresses
- Sent and deleted items since the click
- Sign-in log: country, device, time
- Apps and add-ins with mailbox permission
- Changed bank details in any supplier mail
Warn the accounts desk the same day
Money is what the attacker wants. Tell whoever approves payments that a mailbox may be compromised. Any request to change bank details, rush an invoice or buy gift vouchers needs a phone call first. Use a number already in your records, never one copied from the email.
If the staff member deals with customers or suppliers, send a short note to the people they mailed recently, naming no panic and no blame. Keep it plain. Say that mail from this address may be unreliable until you confirm it, and give a phone number to ring if a request looks unusual. Readers will thank you.
Log it and make the next one faster
Write a short incident note: who clicked, when, which link, what was typed, what you reset and who was warned. Keep the original email as evidence, with its full headers, in a folder that only IT and the owner can open. If a payment went out or customer data was exposed, check what reporting duties apply in your country and get proper advice.
Afterwards, show the same message to the team as a ten-minute example. Circle the sender and the link. Ask what gave it away. Add a one-click way to report a suspect email, and tell staff plainly that a false alarm is welcome and never a nuisance. Today, pin the first-ten-minutes steps beside the helpdesk phone.
First-day phishing response card
A card on one page, in three columns: the first ten minutes, the first hour and end of day. Rows hold the steps, such as disconnect, reset, revoke sessions, check rules, warn accounts and log. Each row has an owner box and a time box. A small table at the foot records the sender address, the link, what was typed and who was warned.
Open a blank worksheet to printQuestions owners ask
Should the laptop be switched off?
Disconnect it from the network first. Leave it powered on if you can, because memory may hold clues that a restart wipes. Have your IT support examine it before anyone uses it again.
What if the person only clicked and typed nothing?
The risk is lower. Check the browser downloads folder and run a security scan on the laptop. Watch the account’s sign-in log for a few days, since some fake pages record the visit and send a second, more convincing message later.
Do we need to tell customers?
Tell those who may receive mail from the affected account. Whether you owe a formal notice depends on what data was exposed and on your local rules, so take advice if personal data was in the mailbox.
Can we prevent clicks altogether?
No. Filtering, multi-factor sign-in and a clear way to report mail reduce harm, but someone will eventually click, and the cleverest message fools careful people. A rehearsed response limits the damage.