It is 4:40 on a Friday when your colleague leans into your doorway, and you can tell from her face before she says anything. An email arrived that looked exactly like a shared-document notice from the organization's email provider: the right logo, the right colors, her name in the greeting. She clicked the button, a login page appeared, and she typed her password. The page then showed an error and sent her to the real inbox. Ten minutes later, something about that bothered her enough to walk down the hall.
"I think I did something dumb," she says.
What happens in the next fifteen minutes decides whether this becomes a story she tells at lunch or an incident you spend the next month cleaning up. Most of the outcome rests on two things: the order of a short list of tasks, and the first sentence you say to her. This post walks through both, then closes with the four defenses that make the next click survivable.
First, thank her
Before any technical step, say some version of "you did exactly the right thing telling me this fast," out loud, and mean it.
That is not politeness. Attackers count on embarrassment to buy them days; the person who quietly hopes nothing happens gives the attacker a week of access to the mailbox. Your colleague gave you a ten-minute head start instead. The way you respond right now sets how fast the next person reports, and that speed is the real measure of your organization's security. The colleague who says "I clicked something" within the hour is an asset; the one who stays quiet for a week is the incident.
It is also worth saying, because it is true: this was not a dumb mistake. The misspelled, obviously fake phishing email is largely a memory. AI tools have made it easy to produce messages that read exactly like the services they imitate, and capable, careful people click them every day.
The wrong first moves
Three instincts are common, and each one costs time.
Waiting to see whether anything happens. Automated phishing kits often use a stolen password within minutes, and the absence of visible trouble proves nothing.
Changing only that one password. If the same password, or a close variant of it, is used anywhere else, the attacker now holds keys to those doors too.
Investigating the email by clicking around in it. The lure has already done its job; opening the link again to "see what it was" only risks a second problem.
The fifteen-minute sequence
Step 1: Kill the stolen credential. From a clean device, change the password on the phished account immediately. Then use the provider's sign-out-everywhere control to end every active session, which evicts anyone who already logged in. Confirm two-factor authentication (2FA) is on for that account, or turn it on now. One caution: if the fake page also asked for a 2FA code and she entered it, assume the attacker used it within minutes, and give Step 3 extra care.
Step 2: Chase the reuse. Ask, without judgment, where else that password or a variation of it is used. The vault will know; memory will confess the rest. Rotate each of those accounts too, highest stakes first: email, hosting, registrar, then anything near money.
Step 3: Check what ten minutes could have done. Open the phished account's settings and look for the intruder's housekeeping. The usual suspects are a new forwarding rule quietly copying mail to an outside address, a changed recovery email or phone number, new app passwords, or unfamiliar devices in the sign-in history. Check the sent folder for messages nobody wrote, because a compromised mailbox often sends the same lure to everyone in its contacts. If it did, a short warning to those contacts goes out now. Then glance at anything this account can administer, such as the website, the social accounts, or a shared drive, for recent changes.
Step 4: Report and block. Use the email platform's report-phishing control on the original message, which improves everyone's filters, and report the fake page to Google Safe Browsing. Then send the team a short heads-up with a screenshot of the actual lure: "This one is going around. Nobody be embarrassed; just report it." The incident becomes free training.
Step 5: Close the loop. Write a short incident log entry: what the lure was, when she clicked, when she reported, what was checked, and what was found. If the click-to-report time was short, say so to the team. That number is worth celebrating, because it is your actual security posture.
If the click was days ago
This sequence assumes you learn about the click within hours. If an account is already misbehaving, sending odd messages, locking people out, or showing changed settings, the compromise has matured, and the response shifts to the full hacked-account or hacked-site playbooks. Last Tuesday's post covers the hacked site.
What actually prevents the repeat
Someone will always eventually click. The defenses that matter are the ones that assume it.
The first is a single habit: never log in through a link in a message. When an email says your registrar, your bank, or your shared drive needs attention, go there by typing the address or using the vault's saved link. If the notice was real, it will be waiting there too. Teach that one habit to everyone with a login.
The second is unique, vault-generated passwords for every account, so a stolen password opens exactly one door. The third is 2FA on every account that matters, which makes even that door heavier. The fourth is the reporting norm you reinforced in the first thirty seconds of this story. Yesterday's web check covered the 2FA list; if it is still undone, this post is your reason.
Get the playbook before you need it. The full sequence, with blanks for the account phished, the time, and every rotation, is the "Someone Clicked the Link" playbook from the Web Emergency Playbook. The sampler is free. Print it now, while it is just a Tuesday, and put it where the person in the doorway at 4:40 on a Friday will find it.