Employee Clicked a Phishing Link – What Should We Do?

For a Microsoft 365 account, changing the password is important, but it should not be the only action. Active sessions, mailbox rules and other account activity also need checking.

No. Clicking a phishing link does not automatically mean the account or computer has been compromised.

There is a substantial difference between clicking a link and immediately closing the page, and clicking a link, entering a Microsoft 365 password and approving an MFA request.

The first useful question is therefore not simply “Did you click it?” It is “What happened after you clicked it?”

If the employee clicked the phishing link but did not enter information, download anything or approve an authentication request, the risk is considerably lower.

They should close the page and report what happened. Preserve the original email where possible because the sender, link and message headers may help with the investigation.

Modern browsers and security products provide useful protection against known malicious websites, but no control catches everything. In many cases, clicking alone will turn out to have caused no damage. It is still worth checking rather than guessing.

If an employee entered their password into a phishing website, work on the assumption that somebody else may now know that password.

Change the password, secure the account and revoke existing Microsoft 365 sessions. Modern cloud services use authentication tokens so an attacker who has already authenticated may have an active session even after the password has been exposed.

In plain English: change the password and throw everybody out of the account, then allow the genuine employee to sign back in.

Check recent sign-ins

Review Microsoft Entra sign-in activity for unfamiliar countries, unusual IP addresses, unexpected devices, strange times or patterns of failed attempts followed by a successful sign-in.

Location alone is not proof of compromise. Mobile networks, VPNs and cloud services can make location information look odd. The important thing is the overall pattern.

Check MFA methods

Look for authentication methods the employee does not recognise, such as an unfamiliar authenticator registration or phone number. If the employee approved an MFA request they did not initiate, treat the account particularly seriously.

If an employee approved an unexpected Microsoft Authenticator request, entered an MFA code into a phishing website or otherwise completed the second stage of authentication, assume the attacker may have successfully signed in.

Secure the account, change the password, revoke sessions and establish what the attacker may have accessed after authentication. MFA is extremely valuable, but it is not magic if the user is persuaded to hand over both factors.

This is one of the most important checks after a Microsoft 365 phishing attack or suspected business email compromise.

Attackers can create rules that forward messages elsewhere, delete selected emails, hide replies or move messages into unusual folders. That can allow them to quietly monitor invoices, payment conversations and other valuable correspondence.

A compromised finance mailbox is particularly dangerous. An attacker may wait inside a genuine supplier conversation and later send “updated bank details”. That is much more convincing than a random phishing message arriving from nowhere.

Look for messages the employee does not recognise, including in Sent Items and Deleted Items. Attackers sometimes delete messages after sending them in an attempt to hide their activity.

If fraudulent messages were sent from the account, you may need to warn recipients, particularly where invoices, payment requests or password links were involved.

This is a different problem. If an employee downloaded or opened a suspicious attachment, the risk is not limited to the email account. The computer itself may need investigating.

If malware is genuinely suspected, stop normal use of the machine and contact whoever manages your IT. Depending on the circumstances, isolating the device from the network may be appropriate until it has been checked.

Do not continue logging into banking, Microsoft 365, accounting systems or other sensitive services from a computer you believe may be compromised.

Contact the relevant bank or payment provider immediately. Do not wait for the IT investigation to finish first.

If money has been transferred or fraud has occurred, the incident may also need reporting through the UK's Report Fraud service. The faster a fraudulent payment is identified, the better the chance of stopping or tracing it.

Not automatically. If somebody simply opened a phishing webpage and entered a password, the main problem may be the online account rather than the computer.

If they downloaded or executed a suspicious file, the situation is different and the device may need isolating while it is investigated. The response should fit what actually happened.

Usually, no. If one user entered their password into a phishing website, resetting every employee's password can create considerable disruption without addressing the real problem.

Start with the affected account and investigate. The situation changes if evidence suggests several accounts were compromised, passwords were reused, an administrator account was affected or the attacker gained wider access.

Those accounts must also be considered exposed. Password reuse turns one stolen password into several potential compromises.

This is one reason businesses should use unique passwords and a reputable password manager rather than variations of the same password across several services.

MFA makes a very significant difference, but it does not make phishing impossible. More sophisticated attacks can attempt to capture authentication sessions or persuade the employee to approve an MFA request.

Good security is layered: MFA, email security, managed devices, endpoint protection, updates, sensible administrator permissions, reliable backup and monitoring all contribute. No single product solves the whole problem.

No. That is not simply politeness. It is good security practice.

Employees who fear being blamed may be less likely to report mistakes quickly. You want people to say “I think I've clicked something I shouldn't have” within two minutes rather than two days.

Speed is far more useful than blame.

Not every phishing incident is a reportable personal data breach. Clicking a phishing link by itself does not automatically mean you need to contact the Information Commissioner's Office.

You first need to establish whether personal data was compromised and assess the risk to the people affected. Under UK GDPR, certain personal data breaches must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Not every breach reaches the reporting threshold, but the incident and the decision should be documented.

Suspicious emails can be forwarded to the UK's National Cyber Security Centre at report@phishing.gov.uk. Suspicious text messages can be forwarded to 7726.

If the business has actually lost money or been affected by fraud or cyber crime, the incident can also be reported through Report Fraud.

Immediately. That does not mean every incident requires a dramatic emergency response.

It means establishing what happened while the information is fresh and before an attacker has more time to use any stolen access.

Common warning signs can include unusual sign-ins, unfamiliar MFA methods, unexpected password changes, strange Sent Items, missing messages, new forwarding settings, suspicious inbox rules and colleagues receiving messages the genuine user did not send.

One particularly useful warning is a customer or supplier asking, “Did you really send this?” Do not dismiss that message. Investigate it.

If you believe a business email account has been hacked, treat it as an incident rather than simply a password problem.

Secure the account first, then establish what happened while the attacker had access. A Microsoft 365 identity may provide access not only to email but potentially OneDrive, SharePoint, Teams and other company services.

The investigation should answer two separate questions: Can the attacker still get in? and What did the attacker do while they could get in?

The aim should not be to create a business where nobody ever clicks a suspicious link. That is unrealistic. The better aim is to create a business where one bad click does not become a catastrophe.

That means sensible layers of protection: MFA, email security, endpoint protection, supported and patched devices, backup, limited administrator permissions, monitoring and a clear reporting process.

The technology matters. So does the process around it.

Incident response depends on exactly what happened. The guidance above is aligned with current UK government, NCSC, ICO and Microsoft guidance.