I Clicked a Phishing Link: What to Do in the First 30 Minutes

Phishing is no longer a grammar-mistake email from a fake prince. The attacks we see at Hexafusion in 2026 are brand-perfect replicas of Microsoft login pages, DocuSign notices, QuickBooks invoices, and courier tracking pages. The click itself is not the end of the world if you respond quickly and in the right order. What creates the real damage is panic, delay, and destroyed evidence.

Before You Do Anything Else

Take a breath. Do not delete the email. Do not close the browser tab in a panic. Do not reboot the computer. These are the three most common mistakes people make, and each one destroys evidence your IT team or insurer will need.

What Not To Do (Even When Panicked)

• Do not delete the email. Move it to a folder called "Incident" if you like, but leave it intact. Headers contain the sending IP, routing path, and authentication results your responder needs.
• Do not factory-reset or wipe the device. Forensic artefacts, browser cache, and endpoint detection and response (EDR) telemetry are on that disk.
• Do not pay anything the email demands. No legitimate supplier, courier, or tax agency asks for payment through a link in an unsolicited email.
• Do not tell colleagues through the same email system if you suspect the account is compromised. Use phone, in-person, or a separate channel. Assume the attacker is reading your mail in real time.

Follow-Up Actions (Within 24 Hours)

1. Review sign-in logs

In Microsoft 365, go to Entra ID > Sign-in logs. In Google Workspace, look at the admin console audit log. Flag any sign-ins from unfamiliar countries, impossible-travel patterns (Vancouver at 10:02, Lagos at 10:05), or non-browser user agents. Keep a screenshot of anything suspicious before the logs roll off.

2. Run a full EDR scan

If your organisation deploys endpoint detection and response, trigger a full scan on the device. If you only have basic antivirus, this is a good moment to discuss upgrading. For context on why, see our article on malware versus ransomware for BC small businesses.

3. Warn the right people, the right way

Tell your direct manager and IT team by phone or in person. If the phishing email pretended to be a supplier or client, let that party know out-of-band (not by replying to the email). They likely have other victims and need to warn their own users.

4. Report the phishing attempt

Forward the email, with full headers, to the Canadian Centre for Cyber Security at cyber.gc.ca. If money or credentials were lost, file a report with the Canadian Anti-Fraud Centre (CAFC). These reports feed threat intelligence that benefits every other business in Canada.

When to Escalate to a Full Incident

Escalate from a "user clicked a link" ticket to a full incident if any of these are true:

• Credentials were entered on the fake page.
• Sign-in logs show unfamiliar successful logins.
• Sent items contain messages you did not write.
• Inbox rules you did not create were present.
• The user has privileged access (finance, HR, M365 admin).
• Any file was downloaded or a document was opened after the click.

At that point you are no longer dealing with a near-miss. You are dealing with a business email compromise or pre-ransomware foothold, and you need the response plan in our ransomware first-60-minutes article.

Prevention Starts With Realism

The goal is not zero clicks. Humans will click. The goal is that when someone clicks, the blast radius is small: MFA blocks the login, conditional access flags the foreign IP, EDR kills the payload, and the monitoring team sees the alert before the attacker pivots. That is what layered defence looks like in practice, and it is what separates a ten-minute ticket from a six-figure incident.

If your current setup cannot answer "what happens when someone clicks", that is the conversation to have before it is tested by a real attacker.

Related articles: Ransomware Note on Your Screen: The First 60 Minutes · Malware vs Ransomware for BC SMBs · Password Length and Crack Times

← Back to Blog