I already clicked a phishing link or entered my password — what to do next

Updated 1w ago 16 views 9 min read
phishing security password incident microsoft 365 email security what to do
In This Article

Got an email that turned out to be phishing — and you already clicked, signed in, opened something, or replied? You are not the first person this week, and you are not in trouble for telling us. Looking this up was the right move. Speed and a calm checklist matter more than a perfect write-up.

Heads up — managed clients only. The response steps below are how we support The I.T. Experience managed clients. If you are not a client and you are worried about an account, contact that service’s support from a device you trust.
Stop interacting, contact us, we reset and check

The 30-second version

  1. Stop interacting with the email and the website. Close the tab. Do not click “log in again” to see if it still works.
  2. Do not warn the office by forwarding the phishing email to a distribution list. That spreads the bait. Tell a neighbor verbally, or open a normal support request.
  3. Contact us right away — submit a support request (choose Security Concern) or email [email protected] — with the five facts below.
  4. If you typed a password or approved an MFA prompt you did not mean to: do not try to “fix” it yourself with a self-serve password reset. Stop using that session, contact us, and we will reset the password and revoke sign-in sessions with you.
Credentials or MFA involved in the last hour? Start your request with "Business-critical: credentials entered", and choose High if the form asks how urgent it is, so it is picked up first.

Which path am I on?

Pick the first row that matches. You can belong to more than one — follow the stricter path (B, C, or D over A).

What happened Start here
Clicked a link, but did not type a password or approve a sign-in request on your phone Path A
Typed your username/password, or approved a sign-in request on your phone (Microsoft Authenticator) that you did not mean to Path B
Opened an attachment, or ran a downloaded file / “security update” Path C
Replied with sensitive info (payroll, wire instructions, W-2, invoice change) Path D
Path A link only, Path B password or MFA, Path C attachment, Path D sent sensitive info
  1. Close the browser tab. Leave the site alone.
  2. Note the approximate time and the sender display name (do not click again to look things up).
  3. Leave the message in your inbox for now. After you have contacted us (or when we ask), you can report it using How to send us a suspicious email for automated analysis.
  4. Message us with the five facts. We will tell you if anything else is needed.

You often will not need a password reset for Path A. We would rather confirm than guess.

Still unsure whether you typed anything? Treat it as Path B and contact us. Over-reporting is fine; under-reporting is how small events get bigger.

Path B — Password or MFA

This is the path where we want a ticket first — not a DIY password change.

  1. Stop using that browser session for work email, Teams, or portal sign-ins. Close the tab/window.
  2. Do not approve any further MFA / Authenticator prompts you did not just initiate yourself. If one appears on your phone, tap No, it's not me (1), then tell us in your request.
A phone showing a Microsoft Authenticator request: Are you trying to sign in? Contoso, jordan.taylor@contoso.com. Enter the number shown to sign in, with an empty number box. The No, it's not me button is marked 1. The Yes button is not marked.
  1. Contact us immediately. Submit a support request (choose Security Concern) or email [email protected].
  2. Say clearly that credentials or MFA may be involved so we prioritize a password reset and session revocation.
  3. Keep the device you used nearby. We may ask whether Outlook, Teams, or the browser looked unusual afterward.
Do not use a self-serve password-reset page as your first move after phishing. Changing the password yourself (or inside the same browser that just phished you) is not enough and can leave stolen sessions active. Even if you know how to reset passwords, we still need a ticket. We also check mailbox rules and confirm nothing else is open. Submit a ticket — we reset the account and revoke sessions on our side.

Path C — Attachment or something ran

  1. Disconnect from Wi‑Fi or unplug Ethernet if you are comfortable doing that; leave the computer powered on.
  2. Do not start deleting files, installing cleanup tools from a pop-up, or resetting Windows yourself.
  3. Submit a support request right away (choose Security Concern; use another device if this one is disconnected). Say you opened or ran something from email.
  4. Capture what you can without digging: filename, approximate time, any on-screen message. See also Reporting an IT Security Incident.

If what you saw looked like a fake virus / “call Apple/Microsoft” scare screen, also read Fake virus pop-ups and tech-support scams — and still tell us.

Pop-up says call a 1-800 number or install a “cleanup” tool? Close the browser if you can; do not call numbers from the pop-up; do not download their tool. Submit a support request to us instead.

Path D — You sent sensitive information

  1. Submit a support request right away (choose Security Concern) and start it with "Business-critical: sensitive information sent". This is the path where minutes matter for finance and HR follow-up.
  2. Tell us who you replied to, what you sent, and whether money, payroll, W-2, or invoice/banking changes were involved.
  3. Do not send a “correction” email on the same thread until we say so — attackers often watch those threads.
  4. If you also typed a password along the way, follow Path B’s contact steps as well (ticket → we reset).

Do this now (ordered checklist)

Use this when you want one list instead of path cards:

  1. Leave the site/tab. Do not “log in again to check.”
  2. Do not forward the phishing email to coworkers as a warning.
  3. Contact us: support request (Security Concern) · [email protected].
  4. If Path B: say credentials/MFA were involved — we handle the reset and session revoke.
  5. If Path C: disconnect network if you can; leave the PC on; wait for us.
  6. If Path D: ticket first, marked business-critical; do not reply again on that thread.
  7. Have the five facts ready.

The five facts we need

Copy/paste into your support request or email:

  1. About what time it happened (include time zone if you are traveling).
  2. What you did — clicked / typed password / approved MFA / opened attachment / replied with sensitive info.
  3. Which account — usually your work email address.
  4. Which device — office PC, laptop, phone; home or office network.
  5. Whether anything seemed to install, or whether a ransom / “locked files” / scareware message appeared.

Anything else is bonus (subject line, screenshot of the message without clicking links again). Those five let us start.

Opening a support request? Put “Possible phishing — credentials entered” (or “link only” / “attachment opened”) in the subject so it is easy to prioritize.

What we typically do on our side

You do not need to run these yourself. Depending on the path, we may:

  • Reset your password with you and revoke sign-in sessions
  • Check your mailbox for forwarding rules or inbox rules you did not create
  • Search for the same campaign across your organization
  • Check the device health tooling already on managed computers
  • Walk finance / HR through next steps if Path D applies
  • Ask you to forward the original as an attachment for analysis once the urgent steps are done — see How to send us a suspicious email…

We will tell you what we changed and whether you need to sign back into Outlook, Teams, or other apps on each device.

Why we insist on a ticket for Path B: A password change alone does not always kick out a session the attacker already opened. Our process pairs the reset with session revocation and a quick mailbox check — that is the part clients cannot see from a public reset page.

What not to do

Skip these — they make things worse or burn time we need:

  • Do not pay a ransom, “fine,” or gift-card demand from a page or email.
  • Do not call a phone number from the suspicious email or pop-up.
  • Do not run cleanup tools advertised by the page you landed on.
  • Do not wipe your PC or reinstall Windows unless we ask you to.
  • Do not blast the original phishing email to “All Staff.”
  • Do not treat a self-serve password-reset page as the whole fix after phishing — contact us so we can reset and revoke properly.

If you are on the road with only a phone

Submit a support request from your phone's web browser (the form works on phones), or email [email protected], with the five facts and “credentials involved” in the subject when that applies. A short request now beats a perfect write-up tonight. When you can reach a desktop later, you can still forward the original as an attachment for analysis.

Aftercare (next few days)

  • Treat unexpected password-reset messages seriously — tell us if you did not request a reset (and did not just finish one with us).
  • If colleagues ask “did you email me to buy gift cards / change wiring?”, call them back on a known number and submit a support request to tell us.
  • If Outlook rules, auto-forwarding, or your signature changed, tell us even if mail seems fine.
  • Approve MFA prompts only for sign-ins you just started.

Need us now? Submit a support request · [email protected]

Was this article helpful?