You click a link in an email.
The page opens, and for a moment everything looks normal.
Then you notice something.
Maybe the website address looks strange. Maybe the login page isn't quite right. Or maybe you've already entered your password before realising:
At that point, most people have the same immediate reaction: Have I just been hacked?
Not necessarily.
Clicking a phishing link and having your account compromised are not the same thing. What really matters is what you did after the click. The recovery playbook I used for this article makes the same distinction: simply opening a page is treated differently from entering credentials, downloading something or granting permissions.
So before you panic, think back for a second:
Your answer tells you what to do next.
This is probably the first thing people search after realising they've clicked something suspicious: “I clicked a phishing link but didn't enter anything. Am I okay?”
If the page simply opened and you closed it without entering information, downloading anything or giving the website permissions, that's generally a much lower-risk situation.
Your recovery playbook classifies this separately from cases where credentials were submitted or files were downloaded.
The UK's National Cyber Security Centre (NCSC) also says that if you've already clicked a suspicious link but haven't provided sensitive information, there may not be anything further you need to do, although you should remain alert for suspicious activity (NCSC phishing guidance).
Close the page immediately. Don't go back because you're curious. Don't click around trying to work out what the website was doing. And if your browser downloaded something unexpectedly, treat that as a download incident instead.
This is where you need to act.
Imagine the email says:
Review your account now to prevent suspension.
Review Account Now →You click. The Microsoft login page appears. You enter your email and password. Then you look up and notice the URL isn't Microsoft at all.
At this point, don't waste time trying to decide whether the site was definitely malicious.
Open the real service yourself—using the official app, a bookmark, or an address you type in directly—and change the password.
Then ask yourself another uncomfortable but critical question: Where else did I use that password?
If the same password is protecting another account, change it there too. The NCSC specifically recommends changing passwords on other accounts where you've reused the same password after giving credentials to a phishing site (NCSC phishing recovery guidance).
This is one reason password reuse causes so many downstream problems. A phishing page might be pretending to be Microsoft. But the password you gave it might also work on Amazon, Instagram, PayPal or your banking portal. The attacker doesn't necessarily need to hack all of those services—you've accidentally given them credentials they can test across the web.
If several accounts are involved and you don't know where to start, start with your main email account.
Why? Because your email is probably connected to almost everything else in your digital life.
Think about what's sitting in your inbox right now: bank notifications, Amazon orders, job applications, travel bookings, social media alerts, cloud-storage messages, and above all, password reset links.
If someone controls your email account, they may be able to use “Forgot password” on dozens of other services and receive the verification links themselves.
That's why the recovery playbook puts the primary email account first when prioritising password resets, followed by financial accounts, cloud platforms and other online services. Secure the email account first, then work outward.
This is something people frequently miss.
You realise what happened. You change your password. And you think: Done.
Sometimes, yes. But not always.
When you log into a website, the service normally creates a session that keeps you signed in so you don't have to enter your password every time you open another page. More advanced phishing attacks can try to steal that authenticated session as well.
Microsoft has documented Adversary-in-the-Middle (AiTM) phishing campaigns where attackers positioned phishing infrastructure between the victim and the legitimate authentication service. This allowed them to capture credentials and, in some cases, authenticated session cookies (Microsoft's AiTM phishing investigation).
You don't need to understand all the intricate technical details. The practical lesson is simple:
Go into the security settings for the affected account. Look for:
If you see a device or login you don't recognise, remove it. Your recovery playbook warns that changing a password may not automatically terminate every active session, which is why session revocation is an indispensable part of the recovery process.
If your email account may have been accessed, there's another hidden place worth checking: your inbox rules.
It sounds mundane, but think about what an attacker could quietly do with them:
• Rule: Emails containing "bank", "wire", or "statement" → Move immediately to Archive or Trash.
• Rule: Messages containing "security alert" or "new sign-in" → Mark as read and hide.
• Auto-forwarding: Quietly forward a copy of every incoming message to an external address.
You continue using your inbox normally while important warnings disappear before you ever notice them.
The recovery playbook specifically identifies malicious forwarding and inbox rules as something to audit after an email account compromise. Take two minutes to check:
If something is there that you didn't create, remove it immediately and continue investigating the account.
Now we're dealing with a different problem.
Maybe the email didn't ask you to log in. Instead, it said:
"Your invoice is attached." or "Download the document to view your payslip."
You clicked and an unfamiliar file appeared in your Downloads folder.
If you downloaded or opened a suspicious file, your recovery playbook recommends disconnecting the device from Wi-Fi or Ethernet as part of the initial containment process, and checking what was downloaded without opening unfamiliar files.
Then run a comprehensive scan using trusted security software. The NCSC also recommends running a full antivirus scan if you've opened a suspicious link and followed instructions to install software (NCSC guidance after a phishing incident).
And there is one situation where I would not try to fix everything yourself:
Tell your IT or security team immediately. Don't hide it because you're embarrassed about clicking the link. Your recovery playbook specifically recommends notifying the SOC or IT help desk when a phishing incident happens on an enterprise device. From their perspective, knowing within 10 minutes makes containment trivial; finding out days later during an enterprise ransomware investigation is a disaster.
The same basic question applies: What happened after you clicked?
If a website opened in Safari or Chrome and you immediately closed it, that's very different from installing an app profile, downloading an APK, or granting permissions.
If you did install something:
And do not respond to the situation by downloading a random “virus cleaner” advertised online. Use the built-in security features provided by your device manufacturer (such as Google Play Protect or Apple iOS system protections) or a security product from an established, reputable vendor.
This one is simpler. Don't wait.
If you've entered banking or payment card information into a phishing website, contact your bank immediately using a trusted method—the official banking app, the phone number printed directly on the back of your card, or the bank's official website.
Tell the bank representative exactly what happened so they can freeze or cancel the compromised card and monitor for unauthorized charges. Then review your recent transactions carefully. The NCSC recommends contacting your bank immediately if you've given away banking details (NCSC phishing guidance). Even if no money has disappeared yet, the card data may already be queued for automated testing.
Multi-Factor Authentication (MFA) definitely helps.
If an attacker only steals your password from an old database or a basic login clone, MFA stops the vast majority of automated account-takeover attempts. But don't treat MFA as permission to stop checking links.
Remember the Adversary-in-the-Middle (AiTM) attack we discussed earlier? Some modern phishing infrastructure is designed to sit between you and the legitimate service while you are actively logging in. Microsoft has documented widespread campaigns where this technique was used to capture session tokens right after victims completed their normal MFA prompt (Microsoft — From cookie theft to BEC).
This is why passkeys and hardware security keys (FIDO2) are becoming the gold standard: they bind authentication cryptographically to the exact website domain in your address bar, making traditional phishing and AiTM interception physically impossible. Your recovery playbook similarly recommends strengthening authentication with passkeys and hardware keys after any credential exposure incident.
You don't need to perform every single recovery step found on Google. Your response should match what actually happened. Use the selector below to diagnose your situation and follow the immediate containment checklist:
Select what happened after you clicked to reveal your tailored response playbook:
People click phishing links. It happens at work. It happens at home.
It happens because you're expecting a parcel, waiting for an invoice, checking something quickly on your phone or trying to log into an account right before a meeting.
The useful question afterwards isn't:
It's:
Maybe the answer is nothing. Maybe it's a password. Maybe it's a card number. Maybe it's a downloaded file. Maybe it's an authenticated session.
Once you know that, the situation becomes much easier to deal with:
Because after a phishing click, what you do next usually matters far more than the click itself.
This research synthesises industry-standard incident containment workflows, triage playbooks, and published guidance from national cybersecurity agencies:
Have a question or a suggestion? Prepare an email below. Feedback is private and is sent only when you press Send in your email app.
Likes and claps are your personal reactions on this device.
You can also email Poorna directly.
Your feedback stays private. Nothing is sent from this page automatically.
I started Cyber Insight because everywhere online people only talk about cybersecurity in technical terms — and most people are left without a proper understanding of how the digital world works. I work in cybersecurity, but I write here for everyone. No jargon. Just clear, honest explanations.