A staff member clicked a dodgy email link: what to do in the next hour
⏱ In about 10 minutes
Affiliate disclosure: Some links on this page may become affiliate links. If you buy, we may earn a commission at no extra cost to you. Commissions may influence which products we choose to cover, but not our assessment of them. Read the full disclosure.
In this article
The short answer
Short answer
Act fast and keep it calm. Disconnect the device from the internet, change the password of any account they typed in (from a different, clean device), turn on multi-factor authentication (MFA), run a security scan, and report it. If money or bank details were involved, call your bank first.
The Australian Cyber Security Centre's (ACSC) own summary: "Disconnect affected devices from the internet, change your passwords and scan for viruses." (ACSC)
Then make the next click less likely with MFA, a password manager and business security software such as Bitdefender.
First: thank them for telling you
This matters more than it sounds. A staff member who reports a click in five minutes is worth far more than one who hides it for a week. The UK NCSC warns that punishing people for clicking means "employees who are afraid for their jobs will not report mistakes," and suggests measuring "how many people reported it", not only how many clicked. (NCSC, Phishing guidance)
Phishing is common. The ACSC's latest threat report says phishing was recorded in 60% of the incidents reported to it in 2024–25. (ACSC Annual Cyber Threat Report 2024–25) It can happen to anyone.
Do now: the first hour
Step 1: Find out exactly what happened (5 minutes)
Ask, without blame:
- Did they just click, or also type a password, download a file, approve a login prompt, or install anything?
- Which account or device?
- Did they share bank or card details, or pay anything?
Step 2: Disconnect the device (1 minute)
Turn off Wi-Fi and unplug the network cable. If malware may be involved, the ACSC says to "disconnect it from the network and seek assistance from an IT professional as soon as possible." (ACSC, Common cyber threats)
Step 3: Call the bank if money or financial details are involved (10 minutes)
The ACSC says to "contact your bank or financial institution immediately" if you believe your business has lost money or financial information has been compromised. (ACSC)
Step 4: Change passwords, from a clean device (15 minutes)
If they typed a password into the fake page, change it now using a different device. Then change it anywhere the same password was reused. The NCSC explains why both matter: criminals "will try the same 'hacked' password across multiple accounts." (NCSC, Recovering a hacked account)
Step 5: Sign out everywhere and turn on MFA (10 minutes)
Log the account out of all devices and sessions, then make sure MFA is on. Never approve a login prompt you didn't start. See our two-factor setup guide.
Step 6: Check email rules and forwarding (10 minutes)
This is the step most people miss. The NCSC says a "common tactic used by cyber criminals is to set up a forwarding rule", so they keep receiving copies of your email. (NCSC) Check the mailbox for rules or forwarding addresses you didn't create, and delete them.
Step 7: Scan the device (30 minutes)
Run a full scan with your security software. The ACSC suggests you "run antivirus or security software to scan your device and remove any suspicious programs." (ACSC) If anything is found, or you're unsure, get an IT professional before reconnecting it.
Next: check accounts and warn people (the rest of the day)
- Look for signs of compromise. The ACSC lists warning signs such as changes you don't recognise, unexpected password reset notifications, and being logged out on all devices. (ACSC, Recover from account compromise)
- Review recent logins for unfamiliar devices or locations. (ACSC)
- Warn your contacts if the email account may have been used to send messages, so they treat anything recent with suspicion.
- Tell your team what the email looked like, so nobody else clicks it.
- Write down what happened: times, what was clicked, what you changed. You'll need it for any report.
Where to report it
- Australia: report through ReportCyber. The ACSC's hotline is 1300 CYBER1 (1300 292 371). (ACSC)
- UK: forward suspicious emails to [email protected], the NCSC's reporting service, as explained on its report a scam email page. If you've lost money, the NCSC says to tell your bank and report it as a crime. (NCSC)
- US: the FBI's Internet Crime Complaint Center (IC3) is "the central hub for reporting cyber-enabled crime." See also CISA's phishing guidance.
- Personal data involved? You may have legal duties to notify. In Australia, businesses covered by the Privacy Act must report eligible data breaches to the OAIC. (ACSC) Check your national privacy regulator.
Prevent the next one
- MFA on every important account, so a stolen password isn't enough.
- A password manager. It only autofills on the real website, which is a quiet but useful check against fake login pages.
- Security software with web protection on every device.
- A written rule for payment changes: always confirm by phone using a known number. The ACSC: "Always verify payment recipients before sending money." (ACSC, Educate staff)
- Short, regular awareness chats, plus a one-click way to report suspicious emails.
Quick pick
Quick pick: tools that make the next click less damaging (product details from official vendor pages, checked 18 Oct 2026. Not hands-on tested. No ratings. Confirm prices and features on the vendor's site.)
- Best for most small teams (device protection): Bitdefender GravityZone Small Business Security. Bitdefender says it "automatically blocks known phishing sites, displaying a warning page instead", includes ransomware mitigation, and is managed from one console for 1 to 100 devices. Pricing depends on device count. → See our cybersecurity guide
If you're on a tight budget (passwords and 2FA): Proton Pass. Pass Essentials listed at US$1.99 per user/month billed yearly (minimum 3 users) at a discounted rate, with a built-in 2FA authenticator and dark web monitoring. → See our password manager guide- If you want the most complete password manager: 1Password. Business plan alerts on breached, weak or reused passwords. Teams Starter Pack listed at US$24.95/month billed annually for 10 members. → See our password manager guide
Honest limits
Free: the Small Business Password & Access Checklist
A 1–2 page checklist that turns this article into a to-do list: which accounts to protect first, how to set up shared access, and what to do when someone joins or leaves.
You only get emails if you tick the consent box. Unsubscribe any time. See our privacy policy.
Frequently asked questions
They only clicked and didn't type anything. Are we fine?
Probably less at risk, but still scan the device and watch the account for a few days. Some links try to download malware.
Should we tell customers?
If the email account may have sent messages, yes: warn them to ignore recent unexpected requests. If personal data may have been accessed, check your legal notification duties.
Should the staff member be disciplined?
For an honest mistake that was reported quickly, the NCSC's guidance argues against punishment because it stops people reporting. Focus on fixing the system.
Is it worth paying for phishing training?
Short, regular awareness helps, but the NCSC says no training "can teach users to spot every phishing attempt". Pair it with MFA, filtering and a no-blame reporting culture.
Related guides
- Cybersecurity tools
- 10-step basic cybersecurity checklist
- We've never turned on two-step login
- Do I really need antivirus on business laptops?
Sources
Government bodies first. All links checked and loading on 18 Oct 2026.
- Australian Cyber Security Centre: Recover from hacking · Recover from account compromise · Submit a report
- Australian Cyber Security Centre, Small business cyber security handbook: Common cyber threats · Educate staff · Protecting business & customer data
- Australian Cyber Security Centre: Annual Cyber Threat Report 2024–25
- UK National Cyber Security Centre: Recovering a hacked account · Phishing attacks: defending your organisation · Report a scam email
- US: FBI Internet Crime Complaint Center (IC3) · CISA: Recognize and report phishing
- Vendor pages (checked 18 Oct 2026): Bitdefender GravityZone Small Business Security · Proton Pass for business · 1Password business pricing
About our review process
We pick products from official information and say clearly when we haven't tested something hands-on. Commissions may influence which products we choose to cover, but not our assessment of them. See how we work.