Clicked a phishing link? Do these 5 things in the next 10 minutes

First, take a breath

It happens to careful people every day. Phishing emails are written to catch you when you're busy, and the good ones look exactly like the real thing. Feeling a jolt of "oh no" is normal.

What matters now is the next ten minutes. The worst thing you can do is close the tab, hope for the best and say nothing. The best thing you can do is follow the steps below and tell someone. Nobody sensible will be cross with you for reporting it quickly.

The 5 steps

1. Stop, and disconnect if you downloaded anything

Close the page. Don't enter anything else. If you downloaded a file, opened an attachment or ran something, disconnect that device from the internet: turn off Wi-Fi or unplug the network cable. Leave the device switched on, so whoever helps you can see what happened.

2. Tell someone straight away

Tell IT, or your manager if there's no IT person. Say what you clicked, when, and whether you typed anything in. If you entered bank or card details, call your bank now using the number on the back of your card, or call 159. The sooner people know, the more they can do.

3. Change the password from a trusted device

If you typed a password into the page, change it. Do this from a different device you trust, not the one you clicked on, in case that one has been affected. Go to the real site by typing its address yourself. If you use the same password anywhere else, change it there too.

4. Make sure MFA is on

Multi-factor authentication (a code or prompt on your phone as well as your password) means a stolen password on its own isn't enough. Check it's switched on for the account. While you're in the security settings, sign out of other sessions if the account offers it.

5. Report the email

Forward it to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk, and to whoever handles IT for you, so they can warn colleagues who got the same message. Scam texts can be forwarded to 7726. If money was lost, report it to Report Fraud (reportfraud.police.uk, which replaced Action Fraud) in England, Wales and Northern Ireland, or to Police Scotland on 101.

Over the next few days

Keep an eye on the account. Look for sign-ins you don't recognise, emails you didn't send, new forwarding rules, or password reset messages you didn't ask for. Tell IT if anything looks odd.

If the account holds customer or staff information, there's one more thing to check. Under UK GDPR, a personal data breach that's reportable must be reported to the ICO within 72 hours of you becoming aware of it. Not every click is a reportable breach, so a small business should check with whoever handles data protection as soon as possible rather than guess.

Finally, for managers: thank the person who spoke up. How you react this time decides whether the next person tells you or keeps quiet. That's why Lureproof's practice emails never shame anyone. If someone clicks one, they see a 60-second lesson showing the red flags they missed, and that's it. Print this checklist, stick it by every desk, and our free security training covers the rest.

FAQ