IT ISSUE · SECURITY AND THREATS
User clicked a phishing link
Somebody clicked something they shouldn't have. What matters now is what happened next, and reporting it today is what keeps it small.The click itself isn't always where the damage happens. What matters is what happened in the next thirty seconds: whether a password was typed into the page that opened, whether a file was opened and whether an approval prompt was tapped afterwards.
Worth establishing straight away
- Whether any password was entered, and which one.
- Whether an MFA prompt arrived afterwards, and was approved.
- Whether a file was downloaded or opened.
- Whether the same password is used anywhere else.
- Who else received the same message.
If money has already been sent, call your bank straight away. Recalling a payment is time-critical. It's the bank's job, not ours.
What we can do, and what we don't
We review the affected account, its recent sign-ins, mailbox rules and registered methods. Where we're permitted, we work through the practical containment steps and check who else was targeted.
We aren't a forensic investigation service and we don't handle breach notification. Where either is needed we say so and coordinate with a specialist, your adviser or your insurer.
Please keep the message rather than deleting it, and tell us even if you are fairly sure nothing happened. The cases that become expensive are almost always the ones somebody was too embarrassed to mention for a day.