Answers › Technical support and security
What should you do if an employee clicks a phishing link?
Stay calm and do not blame the person. In the first hour, find out what was clicked and entered, take the device off the network if something downloaded or installed, change the passwords the person used, starting with email, report and delete the message, and tell whoever looks after your IT. If a password was typed in, treat it as a hacked-email case. If customer data may be exposed, treat it as a data breach.
The first hour, in order
CISA's phishing page for small businesses says "Most online attacks begin with a single click." A click is a reason to act quickly, not to look for someone to blame.
The steps themselves are the ones the related answer on spotting a phishing email already lists from CISA and the FTC: report and delete the message, change the passwords the person used starting with email, take an infected device off the network, and tell coworkers, because an attack often hits more than one person. What this page adds is the order, and what to do next depending on what the person did.
- Thank the person for telling you. As general advice, a person who fears blame is more likely to stay quiet next time.
- Write down what was clicked, when, whether anything downloaded or installed, and whether a password, code or card number was typed in. The table below starts from that note.
- If a password was typed in, change it from a different device, in case the first one is infected (general advice).
What happened decides the next step
This table is general advice, except where a source is named on this page.
| What the person did | First step | Next |
|---|---|---|
| Clicked, then closed the page; typed and downloaded nothing | Report and delete the message; tell IT | Watch the account for odd activity |
| Typed a password or sign-in code | Change that password, then the email password | The related answer on a hacked business email account |
| Downloaded or opened a file, or installed something | Take the device off the network; call IT | See calling a professional, below |
| Entered payment details, or customer data may be exposed | Call the bank or card company; list what was exposed | The related answer on what to do after a data breach |
When to call a professional
Call an IT provider or security professional if a file was downloaded or opened, the device behaves oddly or shows a lock or payment message, emails the person did not write have been sent, money moved, or nobody on your team can check the account's settings. As general advice, an early call usually costs less than a long clean-up. The FTC's phishing section says that if customer or personal data was exposed, the affected people should be notified, and it points to its data breach guide.
Before the next click
The related answer on spotting a phishing email covers how to make reporting normal; the related answers on multi-factor authentication and on small business cybersecurity basics cover the wider steps that make the next click matter less.
Sources
- CISA, "Teach Employees to Avoid Phishing"
- Federal Trade Commission, "Cybersecurity for Small Business" (September 2025), Phishing section
Related answers
- How do you spot a phishing email or text, and what should staff do with it?
- What should you do if your business email account is hacked?
- What should a small business do after a data breach?
- What is multi-factor authentication, and should every business account use it?
- What are the basic cybersecurity steps for a small business?
Ongoing technical support
The site goes down, email stops arriving, a domain is about to lapse, nobody knows the password. Many owners do not have a technical person. We are that person, for everything we build and the things you already have.