You clicked a phishing link. Here's what to do in the next ten minutes

You clicked, and a second later you knew. It happens to careful people every day, because the emails are now very good. KnowBe4's 2026 research found that 86% of phishing attacks use AI (KnowBe4), which means no spelling mistakes and no clumsy English to warn you.

Don't close the laptop and hope. What you do in the next ten minutes decides whether this is a non-event or the start of a bad month, and the right steps depend on what happened after the click.

First: which of these happened?

What happened	Treat it as
A page opened and you closed it	Low risk. Report it.
You typed your password	A stolen password
You entered a code, or approved a prompt on your phone	Someone signed in as you, right now
You opened a file, or clicked "Enable content"	An infected computer
You called a number, or let someone connect to your screen	An infected computer and stolen passwords

Find your row, then follow the matching steps below. If you aren't sure which row, take the worse one.

If you only clicked

1. Close the tab. Don't go back to "check."
2. Leave the email where it is. Don't delete it, and don't forward it to colleagues to ask what they think.
3. Report it to whoever looks after your IT, with the time you clicked.
4. Carry on working. On an up-to-date computer a click alone rarely does damage, but only someone who can see the records can confirm that.

If you typed your password

1. Move to a different device, such as your phone on cellular data.
2. Change that password now.
3. Ask for a sign-out of every session. A new password doesn't always close a session the attacker has already opened.
4. Change the same password everywhere else you used it. Attackers try it on your bank, your payroll and your client portal within minutes.
5. Report it, even if you think you were fast enough.

Then have someone check the mailbox for new rules and forwarding. The steps are in your work email was hacked.

If you entered a code or approved a prompt

Treat this as a live break-in. Multi-factor authentication stops most attacks, but a fake sign-in page can pass your code along to the real site as you type it.

1. Do everything in the list above, immediately.
2. Call, don't email. The attacker may be reading your mailbox.
3. Go straight to the first-hour plan for a hacked mailbox.

If you opened a file

1. Cut the computer off from the network. Unplug the cable and turn off Wi-Fi.
2. Leave it switched on. Turning it off can destroy evidence and rule out some ways of recovering.
3. Don't plug anything in, and don't open shared drives.
4. Call your IT provider from your phone.
5. Change your passwords from a different device. Passwords saved in the browser are often the first thing taken.

If files start changing names or a ransom note appears, move to the first hour of a ransomware attack.

If you called a number or shared your screen

1. Disconnect from the internet and leave the computer on.
2. Call your bank if you signed in to banking or read out a card number while they were connected.
3. Change every password you typed during the call, from another device.
4. Call your IT provider. The remote-access program they had you install has to be found and removed.

For the owner: the next hour

If a member of staff has just told you they clicked, the firm has work to do too.

• Find out who else received it. Phishing rarely goes to one person. Every copy has to be found and removed from every mailbox before someone else opens it.
• Block the sender and the link.
• Check the sign-in records for the account: new locations, new devices, new inbox rules.
• Watch that account for thirty days.
• Thank the person who told you. This matters more than it sounds. The most expensive click at any firm is the one nobody mentions. If people expect blame, the next one stays quiet, and you hear about it from your bank.

Why "be more careful" isn't a plan

The old advice was to look for mistakes. AI removed them, as we describe in how AI changed phishing. A message can now arrive in your client's tone, about a real matter, at the right moment.

So assume someone at your firm will click this year. The firms that come through it are the ones where a click doesn't matter much:

• The fake page never loads, because the link was checked first. See email security.
• A stolen password isn't enough, because signing in takes more than a password. See multi-factor authentication.
• The file is stopped on the computer, by protection that watches behavior and a security team that acts on it. See endpoint security.
• Staff have seen one before, because they get realistic practice. See training that works.

Each layer catches what the one before it missed.

The numbers an owner should look at

You aren't buying a guarantee. You're buying fewer clicks that matter, and someone to call the minute one does.

	What it comes to
Our Business plan for ten people, with all four layers above	$1,490 a month, $17,880 a year
A click that becomes payment fraud	About $123,000, the average reported loss in the FBI's 2025 figures
A click that becomes ransomware	Every day the firm can't work. Eight people billing six hours at $200 is $9,600 a day.
A click that exposes client records	Legal advice, notification letters and a claim on your insurance

The FBI figure comes from its 2025 Internet Crime Report: $3.05 billion lost to business email compromise across 24,768 complaints. Put your own headcount and rate into the ransomware line; the example is only an example.

On those numbers, two lost days cost about as much as the whole year of cover. That's the trade: a bill you can budget for, against one you can't.

What to do today

• Print the table at the top and put it where staff will see it.
• Tell your team, in so many words, that reporting a click is always the right thing to do.
• Work through the 15-point security checklist to see which layers you have.
• Book a free review if you'd rather have someone go through it with you.