Phishing Help: What to Do After a Suspicious Email

I clicked a suspicious link

• Close the page. Do not enter anything further or follow any prompts it shows.
• Check whether anything downloaded automatically, and run a reputable security scan.
• Keep an eye on the account the message claimed to be about.

I entered my password

• Change that password now on the real site — typed directly, never via the link — from a device you trust.
• Change any other account that uses the same or a similar password.
• Turn on or check two-step verification (MFA) and review recent sign-in activity.

I downloaded or opened a suspicious file

• Disconnect the device from the network (Wi-Fi and cable) without switching it off.
• Do not open the file again. Run a security scan or ask your IT provider to check it.
• Change important passwords from a different, trusted device.

I sent money or payment details

• Contact your bank or card issuer straight away using the number on your card or their official website.
• Ask them to block the card or try to recall the payment, and note the time you called.
• Keep the message and any payment confirmation as evidence.

I only received the email and did not interact with it

• You are very likely fine. Do not click, reply or open attachments.
• Report it to your email provider or IT team as phishing, then delete it.
• If it came from a contact's address, let them know through another channel.

1. Work out what you actually did — clicked only, typed a password or code, opened a file, or entered payment details. That decides what comes next.
2. Secure money first if any payment or card detail was involved — call your bank or card issuer.
3. Change exposed passwords, starting with email and banking.
4. Check the device if anything was downloaded or opened.
5. Preserve the evidence before deleting anything (see below).
6. Warn anyone who might be targeted next — colleagues or contacts.

• Use a new, unique password for the affected account — not a variation of the old one.
• If you entered a one-time code on the fake page, treat the account as compromised even with MFA switched on.
• Review recent sign-ins, connected apps, new devices, saved payment methods and email forwarding rules.
• Sign out of all other sessions where the service allows it. If your mailbox may be affected, see our guide to a hacked email account.

• Check for new programs, browser extensions or apps you did not install.
• Run a reputable security scan and install pending system updates.
• If it is a work device, tell your IT team before doing anything else so they can check for wider exposure.

• A screenshot or copy of the phishing message, including the sender address and link URL.
• A screenshot of the fake page, if still reachable, without submitting anything further.
• Account sign-in and activity logs from around the time of the click.
• Bank or card statements showing any unauthorised activity.
• A short timeline: when you clicked, what you entered, and what you changed and when.

• Speed matters most with payments — banks have the best chance of stopping or recalling money when told quickly.
• Check statements regularly for several weeks, not just once, and consider a fraud alert if card or identity details were entered.
• If the phishing led to a fake invoice or changed bank details from a supplier, read our guidance on business email compromise and payment fraud.
• Be cautious of follow-up messages offering to "help recover" your money — these are often a second scam.

• A work account or work device was involved.
• You see sign-ins, forwarding rules or password resets you did not make.
• A file was opened and the device has behaved oddly since.
• Customer, staff or other people's personal data may have been accessed — see data breach response for what to document and who may need to be told.
• Money moved, or the attacker used your account to message others.

• Do not go back to the fake page to "check" it or enter anything else there.
• Do not reuse a password you use elsewhere, or a small variation of the old one.
• Do not ignore it because "nothing seems wrong yet" — credential misuse is often delayed.
• Do not delete the message before keeping a copy as evidence.
• Do not attempt to trace or contact whoever sent the message. Cyber Crisis Desk is strictly defensive: no hack-back, no tracing.

• Your bank or card issuer — promptly, if any payment or card detail was entered, or money has moved.
• Your IT team or provider — if this happened on a work device or account.
• The genuine service being impersonated — many providers have a dedicated address for reporting phishing.
• Your data-protection regulator — if other people's personal data was likely accessed. In the UK that is the ICO; other countries have their own authority.
• National reporting channels — for example Action Fraud and the NCSC in the UK, and the equivalent body where you operate.

Cyber Crisis Desk is not a law-enforcement, legal or forensic service and does not report on your behalf. It prepares the structured information you need to do so.

A short free Emergency Check establishes exactly what was entered and where, then selects the matching playbook so you are not guessing at the right order of steps.

• Client Next Action puts password and MFA changes first, so the highest-risk gap closes fastest.
• Evidence requests tell you which screenshots and logs to upload, and store them in your private case.
• Recovery tracks record which accounts and devices have been checked.
• Structured reports assemble the timeline for a bank, provider or authority if needed.
• Monitoring and closure keeps the case open while you watch for follow-on fraud.

See how the guided workflow fits together.

• We cannot recover money already transferred or reverse a card transaction; only your bank can do that.
• We cannot make account changes for you; only you or your administrator can.
• This is guided response, not a substitute for a qualified incident-response team in a severe or regulated case.
• We do not provide legal advice or make legal determinations for you.

I only clicked the link but did not enter anything. Do I still need to act?

The risk is much lower, but check the device for anything downloaded automatically, and keep an eye on the account the message referenced. If in doubt, changing that one password costs little.

I have MFA turned on. Am I safe even though I entered my password?

MFA reduces the risk but does not remove it, especially if you also entered a one-time code on the fake page. Change the password and review recent account activity regardless.

Which passwords do I actually need to change?

Start with the account the phishing page impersonated, then any account using the same or a similar password. A password manager makes keeping every password unique far easier.

How long should I keep watching for fraud afterwards?

Several weeks at minimum for statements and login alerts, longer if identity or card details were involved, since some misuse is delayed to avoid drawing attention.