Pause the interaction
Do not enter further information. Record what you clicked and what happened, then report it through your organization’s established process. Clicking a link does not by itself establish whether an account or device was compromised.
Explain the extent of the interaction
Tell the team whether you entered information, downloaded something, approved a prompt, or sent money. Those details help them decide what to investigate and contain.
Use verified recovery channels
If credentials were entered, use the genuine service’s account controls and follow your security team’s instructions. A serious incident may need investigation beyond a password change. Avoid returning to the suspicious page to test it.
Further reading: NCSC: phishing guidance. This external reference does not imply a partnership or integration.
Browse all resources