How-To · Security & Passwords
What to do if you clicked a phishing link
Clicked a link in a suspicious email, entered your password, or opened an attachment? The steps to take in the first few minutes to protect your work account.
It happens to careful people every day. What matters is what you do in the next few minutes. Acting fast, and telling IT right away, usually stops a bad click from turning into a real problem. Nobody is going to be upset with you for reporting it.
1. Stop and close the page
Don’t enter anything else, don’t download anything, and close the browser tab. If a page is asking you to call a phone number or install something “to fix a problem,” don’t.
2. Figure out what happened
Each of these needs a slightly different response:
| What you did | What to do next |
|---|---|
| Clicked, but didn’t type anything | Close the page and report the email (step 4). Tell IT if anything looked strange. |
| Typed your work password | Change your password now (step 3) and call IT. |
| Approved a sign-in or typed a code | Call IT immediately. Someone may already be in your account. |
| Opened an attachment or downloaded a file | Turn off Wi-Fi or unplug the network cable, leave the computer on, and call IT. |
| Entered a credit card or bank details | Call IT, then call your bank or card company. |
3. Change your password if you typed it
Go to mysignins.microsoft.com/security-info yourself (don’t use any link from the email), sign in, and next to Password select Change. Pick a strong password you haven’t used anywhere else. If you used the same password on any other site, change it there too.
Changing your password doesn’t sign out someone who’s already in, so still call IT. They can sign out every session on your account and check for anything the attacker changed.
4. Report the email
Use the Report button in Outlook so your security team sees it and similar emails get blocked. See How to report a phishing email in Outlook. Don’t forward it to coworkers to ask if it’s real.
5. Watch for warning signs
For the next few days, tell IT right away if you notice:
- Sign-in approval requests on your phone that you didn’t start
- Emails in your Sent Items that you didn’t send
- Replies to messages you never sent, or coworkers asking about an odd email from you
- Missing emails, or new rules moving your mail into folders
Get help now
Matter of Technology clients: call (844) 628-8371 right away. The first few minutes matter most, so call instead of emailing.
Want to catch the next one before you click? Read How to spot a phishing email in 10 seconds.