Phishing · What to do next
What Should I Do If an Employee Clicked a Phishing Email?
Act quickly, but don't panic. Disconnect the computer from the network, change the employee's password from a different device, and report it to your IT provider right away. What happens next depends on whether the employee entered a password, opened a file, or only clicked the link.
By SupportMax · Updated October 13, 2026
Do this in the next 15 minutes
1
Disconnect the computer from the network
2
Change the password from another device
3
Report it to your IT provider
SupportMax: 310.331.8119 · Mon–Fri, 9–6 Pacific.
Plain-English guidance
Based in West Los Angeles
Help for clients and non-clients
One accountable team
Video · 30 seconds
Read the transcript
If an employee clicked a phishing email, act quickly, but don’t panic. Disconnect the computer from the network. Change that employee’s password from a different device. Then report it to your IT provider right away. What happens next depends on what they did: clicked the link, entered a password, or opened a file. Each needs different steps, and blaming the employee doesn’t help. Call SupportMax for emergency help.
What might have happened
What did the employee actually do?
The right next step depends on what happened after the click. Ask the employee calmly; honest answers help more than blame.
01
Entered a password
This is the most urgent case. Change that password from another device and check whether multi-factor authentication was on. If the account was taken over, follow our guide to a hacked business email account.
02
Opened an attachment or downloaded a file
The computer may be infected. Disconnect it from the network and don't use it until it has been checked. If files start getting locked or renamed, see what happens after a ransomware attack.
03
Approved a sign-in prompt
If the employee approved an unexpected sign-in or multi-factor authentication prompt, treat the account as compromised.
04
Only clicked the link
This is often lower risk, but the computer and the account should still be checked.
Step by step
The first 15 minutes after a phishing click
These steps are safe for any business to take, whether or not you have an IT provider.
Call 310.331.81191. Disconnect
Unplug the network cable or turn off Wi-Fi on that computer. Leave it powered on so evidence isn't lost.
2. Change the password
From a different, trusted device, change the password for the affected account and any other account that uses the same password.
3. Report and preserve
Report it to your IT provider. Don't delete the email; it helps show what happened.
The next 24 hours
What to check after the first steps
Once the immediate risk is contained, these checks show whether anything else happened.
Check
The account
Recent sign-ins from unfamiliar places
New inbox rules or email forwarding
Messages sent that the employee didn't write
Multi-factor authentication turned on
Contain
The computer
Checked by your IT provider
Kept off the network until cleared
Other computers checked if a file was opened
Backups confirmed in case a restore is needed
Protect
Your business
Warn staff about the same email
Watch for payment-change requests
Tell clients if your email sent them anything suspicious
Plan training for your team
Report phishing using CISA's Recognize and Report Phishing guidance, and report fraud or financial losses to the FBI's Internet Crime Complaint Center (IC3).
After the click
Should the employee be disciplined?
Usually, no. People who are punished for clicking stop reporting, and a quick report is what limits the damage. Thank the employee for speaking up, find out what happened, and use it as a reason to improve training and protections such as email filtering and multi-factor authentication.
Security awareness training →How SupportMax helps
How SupportMax helps after a phishing click
01
Check
We review the account for unfamiliar sign-ins, inbox rules, and sent messages.
02
Contain
We lock down the account, reset passwords, and isolate the computer if needed.
03
Restore
If anything was damaged, we restore from tested backups where possible.
04
Prevent
We tighten email filtering, multi-factor authentication, and staff training.
Working with SupportMax
One accountable team, clear next steps
Calm, plain-English help after a phishing click
Call during business hours, Monday–Friday, 9:00 a.m.–6:00 p.m. Pacific. We help clients and non-clients check what happened and contain it.
Questions
Employee clicked a phishing email: common questions
Have a question that isn't here? Call 310.331.8119 or schedule a free consultation.
Is clicking a phishing link always serious?
Not always. Clicking alone is often lower risk than entering a password or opening a file, but the computer and the account should still be checked.
Should we turn the computer off?
Disconnect it from the network but leave it on, unless your IT provider tells you otherwise. Turning it off can erase information that shows what happened.
What if the employee entered their password?
Change it right away from another device, check for unfamiliar sign-ins and inbox rules, and make sure multi-factor authentication is on.
Do we need to tell anyone?
Tell your IT provider and your staff right away. If money was lost or client data may be involved, talk to your cyber insurer and attorney about any reporting obligations.
How do we stop this from happening again?
Combine email filtering, multi-factor authentication, and regular security awareness training, so a click is less likely and does less damage.
Can SupportMax help if we're not a client?
Yes. Call 310.331.8119 during business hours, Monday–Friday, 9:00 a.m.–6:00 p.m. Pacific.
Someone on your team just clicked a phishing email?
Call 310.331.8119, Monday–Friday, 9:00 a.m.–6:00 p.m. Pacific. We'll help you check what happened and contain it, in plain English. Looking for general IT support in Los Angeles? Start there.
Prefer to call? 310.331.8119 · Mon–Fri, 9–6