If you are asking, “employee clicked a phishing link what to do,” start by staying calm and finding out exactly what happened. A click alone does not confirm that a device is infected or an account is compromised. The next steps depend on whether the employee only opened a link, entered a password, approved an unexpected sign-in request, or downloaded and opened a file.
Move promptly, but do not guess at what the link did. Report the incident, preserve useful details, and involve your IT provider or security contact early if the employee submitted information, opened a file, or saw unusual activity. The NIST phishing guidance for small businesses also emphasizes recognizing and responding to suspicious messages.
Start with a calm, clear report
The employee should tell their manager and the person or provider responsible for IT or security as soon as possible. If your business has an incident reporting process, use it. If not, call the appropriate contact rather than waiting for an email reply when the situation may be urgent.
Ask the employee to report, in their own words:
- What the message looked like and who it appeared to come from.
- What they clicked, entered, approved, downloaded, or opened.
- About when it happened.
- What appeared in the browser or on the device afterward.
- Whether they noticed unexpected sign-in alerts, pop-ups, or other changes.
Keep the original message if possible. Do not click its links again or forward it casually to coworkers. Your IT contact can advise how to share it safely. A useful report is factual and blame-free. The aim is to understand what happened quickly, not to criticize the person who reported it.
Choose the response based on what happened
If the employee clicked but entered nothing and opened no file
Have them close the suspicious page and stop interacting with it. Ask whether they entered any information, accepted a browser prompt, downloaded anything, or approved a sign-in request. If none of those things occurred and the device seems normal, report the click and follow your IT team’s instructions. Do not assume the computer is infected, but do not dismiss the incident either.
An IT professional can review the message and available security activity to determine whether further action is needed. If the employee is unsure what a page did, explain that uncertainty when reporting it.
If the employee entered a work password
Tell IT or your security contact immediately. From a device you trust, the employee or an administrator should change the affected password using the organization’s normal process. The response may also need to revoke active sessions, review account recovery details and sign-in methods, and check for suspicious account activity. A password change alone may not end sessions that are already active.
If the same password was used for other work accounts, tell the IT contact. Do not send passwords through email or chat, and do not use a link from the suspicious message to reach a sign-in page. If the employee approved an unexpected multi-factor authentication prompt, report that as well. An administrator may need to end active sessions and review the account for changes the employee did not make.
If the employee downloaded or opened a file
Contact IT or your security provider right away and describe whether the file was only downloaded or actually opened. If it was opened, the device behaves unusually, or your security contact suspects malware, isolate it from the network according to your organization’s procedure. If you cannot reach IT quickly and you suspect the device is actively affected, disconnect its network connection without deleting files or trying to investigate on your own.
A click by itself is not proof of infection, so disconnecting every device after every click can be unnecessary. When a file was run or there are signs of compromise, prompt isolation can help limit risk. Follow your IT professional’s direction and avoid turning off or wiping the device unless they tell you to, since that may remove information useful for investigating what happened.
Check whether the message reached other people
Ask your IT contact to check whether the same or a similar message reached other employees and whether anyone else interacted with it. This helps the business respond beyond the first report. Do not ask staff to test the link or open the attachment to see what it does.
Your team may need to remove or block the message through its email or security tools, and to review relevant account and device activity. Preserve the message and other incident details until IT advises what to do with them. For background on recognizing suspicious messages, see Zevonix’s guide to spotting a phishing scam.
Know when to escalate
Contact your IT provider or security professional promptly if a password was entered, a multi-factor prompt was approved, a file was opened, the device shows unusual behavior, or an account has unexpected activity. Escalate quickly if the affected account can access sensitive business information or important systems. If your organization has an incident response plan, follow it and involve the designated decision-makers.
If the employee entered payment details, initiated a payment, or acted on changed payment instructions, contact your bank using a phone number or contact method you already trust. If customer or other personal information may have been accessed, notify the appropriate internal privacy, compliance, or leadership contacts and get qualified guidance on the organization’s next steps. If there is evidence of significant unauthorized access or financial loss, your organization may also decide to contact law enforcement.
The NIST guidance on responding to a cyber incident offers a broader framework for managing an incident. For a detailed investigation process, the Microsoft phishing investigation playbook can help IT teams consider what to review.
A practical first-hour sequence
- Report: Tell the right manager and IT or security contact. Share what the employee did and what happened next.
- Contain: Stop interacting with the message. If a file was opened or compromise is suspected, ask IT whether to isolate the device.
- Secure: If credentials or an approval prompt were involved, secure the account from a trusted device and have an administrator consider active sessions and account changes.
- Check scope: Ask IT to look for other recipients, clicks, account activity, or affected devices.
- Escalate: Bring in the bank or appropriate internal decision-makers if payment activity or sensitive information may be involved.
For businesses without in-house IT, reaching an experienced provider early can help distinguish a contained click from a situation that needs hands-on investigation. Zevonix provides managed IT services that include 24/7 monitoring and support. To discuss your business’s IT needs, contact Zevonix.
Frequently asked questions
Does clicking a suspicious link automatically mean the device is infected?
No. A click does not by itself confirm an infection. What the employee did on the page, whether a file was opened, and any unusual device or account activity help determine the response.
Should the employee disconnect their computer from Wi-Fi?
Not automatically after every click. If a file was opened, the device shows suspicious behavior, or IT suspects malware, isolate it from the network following your organization’s procedure or your IT provider’s direction.
Should we change the password or revoke active sessions first?
If credentials may have been exposed, contact IT promptly. They can coordinate a password change and consider revoking active sessions, reviewing sign-in methods, and checking account activity. Do not assume a password change alone ends existing sessions.
What details should the employee report?
Ask what the message looked like, what they clicked or entered, about when it happened, and what the device or browser did next. They should also mention any downloaded file, approved sign-in prompt, or unusual alert.
Respond promptly, without panic
A quick, factual report gives your business a better chance to contain risk and choose the right next steps. Treat the employee as a partner in the response, preserve the details, and involve IT when credentials, files, or unusual account activity are involved. If you need help strengthening your organization’s day-to-day IT support, contact Zevonix to start a conversation.
Stay Informed
Want smarter insights without the noise? Get our latest ideas and strategies delivered right to your inbox.
We respect your privacy. Unsubscribe at any time.