Clicked A Suspicious Link? Here Is What To Do Next

← All ResourcesPractical Guide

If you clicked a link, opened an attachment, or entered your credentials into a page that now seems suspicious, treat it as a potential security incident. The right response depends on what happened. These steps help you organize your next actions; they are not a substitute for emergency incident response.

Steps Worth Taking

1. Stop Interacting With The Message

   Do not reply, enter additional information, approve unexpected login prompts, or call the number displayed in the message. Save enough details for the person responsible for investigating it. Avoid forwarding a suspicious attachment to coworkers.

2. If You Entered A Password, Secure The Account

   From a trusted device, open the service using an address you know is correct. Change the affected password and any other accounts where you reused it. Review active sessions, sign out unfamiliar devices if possible, and check your recovery options and multifactor settings.

3. If You Downloaded Or Ran Something, Get Help

   If a file was opened or software installed, notify your IT or security contact immediately. Follow your organization’s device isolation instructions if there are signs of compromise. Do not run random cleanup programs or erase the device before the situation is assessed.

4. Check Business Email And Payment Changes

   Look for unfamiliar mailbox forwarding rules, security notifications, password resets, or changes to payment instructions. Verify any suspicious invoices or requests through established contact information. If money has been transferred, contact the bank or payment provider promptly.

5. Tell The Right People What Happened

   Report the time, account involved, what you clicked, and whether you entered information. If the situation may affect customer data, involve appropriate legal or compliance advisers. Clear reporting helps others contain the problem and decide what notifications are required.

6. Review What Could Prevent A Repeat

   After the immediate issue is handled, review email security, authentication, access permissions, employee guidance, and recovery procedures. Focus on small, useful changes rather than blaming the person who noticed or reported the message.

For everyday prevention, read our guide to spotting phishing messages. For broader account and response planning, see LochielOak Cybersecurity.

General educational information only. The appropriate steps depend on your business, systems, and circumstances.