What to Do If You Clicked a Phishing Link

It’s 4:40 on a Friday. An email from “Microsoft 365” says your mailbox is almost full. You click, a sign-in page appears, you type your password, and the page just reloads. Something feels off.

First, you are not alone, and you are not the first. Falling for a phishing email takes less than a minute: in Verizon’s phishing tests, the median person clicked 21 seconds after opening the message and typed their details 28 seconds later.^[1] Phishing and spoofing drew more complaints to the FBI in 2025 than any other crime, more than 190,000 of them.^[2]

What matters now is what you do next. Here is how to tell how serious it is, what to do step by step, and what your IT team should check behind the scenes.

First: what exactly did you do?

How worried to be depends on what happened after the click. Find the line that matches yours.

What to do, step by step

Do these in order. The first three matter most.

1. 01

   Stop and close the page.

   Do not type anything else, and do not try to “finish” whatever the page was asking for. Do not delete the email either. IT needs it to see who else got the same message.

2. 02

   If a file opened or downloaded, disconnect.

   Turn off Wi-Fi or unplug the network cable. Leave the computer on so IT can see what happened.

3. 03

   Tell IT right away, by phone or in person.

   Speed matters. In one case Microsoft studied, attackers started trying to steal money within five minutes of stealing a login.^[4] Call rather than email, because if your mailbox is compromised, someone else may be reading it. Microsoft gives admins the same advice about new passwords: never send them by email.^[6]

4. 04

   Change the password from a different device.

   Use a computer or phone you trust, not the one you clicked on. If you used the same password anywhere else, change it there too.^[5]

5. 05

   Have IT sign you out everywhere.

   In Microsoft 365, your administrator can sign you out of every session and check that no strange phone or app was added to your login. A sign-in can keep working for up to an hour after a password change unless sessions are revoked.^[7]

6. 06

   Check for new email rules.

   Attackers often add a rule that forwards your mail to them, or hides replies so you never see them.^[6] IT can find hidden rules that do not show up in Outlook.

7. 07

   Deny any login prompt you did not start.

   An unexpected approval request on your phone means someone has your password. Deny it and tell IT. Attackers sometimes send prompt after prompt hoping someone taps “Approve” to make it stop, and Verizon found that worked in more than 20% of these attacks.^[8]

8. 08

   Report the message.

   Use the Report button in Outlook (Home, then Report, then Report Phishing) so IT and Microsoft see it.^[9] Anyone can also forward phishing emails to reportphishing@apwg.org.^[10]

9. 09

   Write down what happened.

   What time you clicked, what the page looked like, what you typed. Two minutes of notes now saves hours later.

Print or save as PDFOpens a one-page desk card of these steps to print or save. Fill in your IT phone number and post it where everyone can see it.

Why changing your password isn’t always enough

Most people think a new password locks the attacker out. Often it does. But modern phishing kits do something sneakier.

The fake page sits between you and the real Microsoft sign-in. You type your password and your code, the real site lets you in, and the fake page quietly copies the session that proves you are signed in. With that, the attacker is signed in as you, no password or code needed.^[4] Among attacks on Microsoft 365 that got around MFA, Verizon found stealing those sign-in sessions was the most common method, at 31%.^[8]

That is why the fix has more than one step. Microsoft’s own playbook for a compromised mailbox has the administrator reset the password, revoke every active session, review the phones and apps tied to the login, and check for new forwarding and inbox rules.^[6] In Microsoft’s case study, attackers created a rule that moved the victim’s replies into the Archive folder and marked them read, so the victim never saw the conversation the attacker was having in their name.^[4]

None of this means MFA is useless. It still stops most password attacks. It means a stolen login is a job for IT, not just a password reset.

What your IT team should check in Microsoft 365

If you manage IT, or want to know what to ask your IT provider, this is the short version of Microsoft’s response checklist for a compromised account:^[6]

One detail trips people up: app passwords created for older email programs are not removed when the main password changes, so they have to be checked separately.^[6] If nobody at your business owns this list, that is a gap worth closing. It is a big part of what managed IT services covers.

Who to report it to

For owners: make it safe to say “I clicked”

The person who clicked is your fastest alarm. Every minute they spend wondering whether to tell anyone is a minute the attacker keeps.

The UK’s National Cyber Security Centre puts it bluntly: avoid a culture of blame around phishing, because “employees who are afraid for their jobs will not report mistakes.”^[13] Training helps, but mostly with reporting. In Verizon’s data, recently trained employees reported phishing about four times as often as the baseline, while their click rates barely moved.^[8] Some people will always click. The goal is that they tell someone right away.

• Make reporting one click: turn on the Report button in Outlook and tell everyone it is there
• Thank people who report, including the ones who clicked
• Post one phone number for “I clicked something” and make sure someone answers it
• Set up Microsoft 365 so a stolen password alone is not enough to get in

Our plain-English guide to Zero Trust covers the sign-in protections that make a stolen password much less useful, and what happens during a ransomware attack shows how often a phished password is step one.

How to spot the next one: 7 warning signs

Bad spelling used to be the giveaway. Not anymore: CISA notes that AI now helps scammers write clean, convincing messages.^[14] Watch for these instead.

1. It is urgent or scary. Your account will be closed, a payment failed, there was “suspicious activity.” Pressure is the point.^[14]
2. It asks you to sign in or confirm details. Especially through a link in the message.^[3]
3. There is an invoice or payment you do not recognize. Or a link to “pay now.”^[3]
4. The sender or link is slightly wrong. A misspelled company name, a free email address, or a link that goes somewhere other than where it says. Hover before you click.^[14]
5. The link is shortened or hidden. Short links and QR codes hide where they really go.^[14]
6. A familiar name asks for something unusual. Your boss wants gift cards. A vendor has “new bank details.” Call them on a number you already have.^[3]
7. It arrives by text or phone call. Phishing is not just email. In Verizon’s 2026 data, people in phishing tests fell for text and voice messages 40% more often than email.^[15]

When in doubt, do not use the link or phone number in the message. Go to the website or call the number you already know.^[3]

Frequently asked questions