I Clicked a Phishing Link: What a Small Business Should Do in the First Hour

It happens to everyone: an email that looked like it came from the bank, the boss, or a shipping company, a quick click, and a sinking feeling a second later. If you are reading this with the page still open, take a breath. A click is recoverable, and the next hour matters more than the click itself.

This guide covers exactly what a small business should do after a phishing click, in order, and the mistakes that turn a bad moment into a breach.

1. Contain it: stop and disconnect

First, stop. Do not enter more information, do not click “Allow” on any prompt, and do not try to close the page by clicking inside it. Then:

• Disconnect the device from Wi-Fi and unplug any network cable. Do not shut it down if you can avoid it, as that can erase useful evidence.
• Note what happened. Write down the time, the sender, the link, and whether you typed a password or opened a file.
• Call your IT provider now. A phone call beats an email, especially if the attacker may already be in your mailbox.

If a file was downloaded and run, treat it as malware. Your IT team may isolate the machine with endpoint detection and response. Our incident response plan guide shows how to prepare for this moment ahead of time.

2. Reset and revoke: take back the accounts

If you typed a password, assume it is stolen. Use a different, clean device, such as a phone on cellular data, to do the following:

• Change the password for the account, and for any other account that shared it. A password manager makes this painless.
• Sign out of all sessions and devices. Modern attacks steal the session cookie, so changing a password alone may not lock them out.
• Check that multi-factor authentication is on, and review registered devices and authenticator apps for anything you do not recognize.
• Look for suspicious app permissions that the fake page may have granted.

Then check the mailbox for the classic follow-up: a hidden forwarding rule that quietly copies every message to the attacker, which is how business email compromise often begins.

3. Report and review: limit the spread

Phishing rarely targets one person. If one employee got the message, others probably did too.

• Warn the team with the sender and subject line, and ask anyone who clicked to come forward.
• Delete the message from every mailbox, and block the sender and link at your DNS filter.
• Review sign-in logs for unfamiliar locations or times. See our guide to audit logs.
• Check legal duties. If personal data was exposed, California’s breach notification law may apply, and your cyber insurance policy may require prompt notice.

Afterwards, hold a short, blame-free review. The goal is to learn: was the email convincing, did filtering miss it, would awareness training have helped? Many of today’s lures are polished by AI, as we explain in AI-written phishing emails.

Common mistakes to avoid

• Waiting to see if anything happens before telling anyone.
• Changing the password on the same device the attacker may control.
• Forgetting to revoke sessions, so the attacker stays signed in.
• Blaming the employee, which teaches the team to hide the next click.
• Skipping the forwarding-rule check in the mailbox.

The takeaway

Everyone clicks eventually. What separates a minor scare from a costly breach is the first hour: disconnect, tell IT, reset passwords from a clean device, revoke sessions, and warn the team. Put these steps on a card by your desk, and make it safe to report a mistake quickly.

Frequently asked questions

{faqhtml}

Prefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.