Clicked a Phishing Link? What to Do in the Next 15 Minutes

You clicked. Maybe you even typed in your password. Your heart rate just went up.

Take ten seconds. What matters now is speed and doing things in the right order, not guilt. A click isn't automatically a disaster: the risk depends on what happened after it.

Find your situation in the table below, then follow the steps.

First: what exactly did you do?

These steps follow the Canadian Centre for Cyber Security's guidance for cybercrime victims. They apply at work and at home.

You typed your password: six steps

This is the most common case, and the one where speed matters most. The fraudster's goal is to get into your mailbox before you react.

1. Change the password from a safe device, typing the service's address yourself. Never through the link you received.
2. Sign out every active session. A fraudster who captured your session can stay signed in after the password changes. In Microsoft 365 or Google Workspace, your administrator can revoke sessions in a few clicks.
3. Check your multi-factor authentication methods. The fraudster may have registered their own phone or authenticator app.
4. Inspect your inbox rules. A rule that forwards mail outside the company or hides certain replies is a classic sign of compromise.
5. Look at your Sent and Deleted items. Messages you didn't write? Your contacts may already be targeted.
6. Change that password everywhere you reused it. The fraudster will try it on your other accounts.

Then turn on multi-factor authentication if it isn't on already, ideally a phishing-resistant method such as a security key or passkey.

You opened an attachment or installed a file

Now the risk isn't just your account. It's your device, and possibly the company network.

• Disconnect the device from the network: turn off Wi-Fi, unplug the cable, close the VPN. If you can, leave it powered on: what's in memory can help IT understand what happened.
• Don't try to "clean" it yourself, and don't delete the email. Its headers are useful evidence.
• Don't use that device to change your passwords. Use another one.
• Phone IT rather than emailing from a mailbox that may be compromised.

Renamed files, a ransom note, several computers acting up? That's no longer a simple click. Go straight to our guide on the first 24 hours of a ransomware attack.

Tell the right people, in the right order

1. Your IT lead or IT provider, immediately and by phone.
2. Your financial institution, if you gave card or banking details. It can block the card and watch for transactions.
3. The Canadian Anti-Fraud Centre, through the federal Report Cybercrime and Fraud platform launched by the RCMP in November 2025, or at 1-888-495-8501. You can report for yourself, for someone else or for a business.
4. Your local police (SPVM in Montréal, Sûreté du Québec, OPP or your municipal force) if you lost money or your identity was stolen. The Cyber Centre recommends reporting cybercrime within 24 hours of discovering it and keeping the report number.
5. 7726, if the bait was a text: your carrier may block the sender.

A word about embarrassment. Fraudsters count on it. The worst outcome isn't the click; it's the employee who says nothing for three days.

For employers: contain, assess, record

If an employee comes to you, thank them first. Then there are three jobs.

Contain. Revoke sessions, reset the account and review the sign-in logs for unusual access. Check whether other employees received the same message, and pull it from their inboxes.

Assess. Could the fraudster read personal information? Picture a small accounting practice in Montréal's Plateau during tax season: one mailbox can hold T4 slips, social insurance numbers and clients' banking details. In Quebec, that's a confidentiality incident under Law 25.

Record and notify. Every confidentiality incident must be entered in your register (s. 3.8). If it presents a risk of serious injury, you must promptly notify the Commission d'accès à l'information and affected individuals (s. 3.5). Law 25 has no fixed 72-hour deadline. Our guide to reporting a confidentiality incident to the CAI walks through the risk assessment, and Cyberattack: who to notify in Canada covers your insurer, the police and partners. Outside Quebec, federal private-sector privacy law has a similar requirement to report breaches that pose a real risk of significant harm to the Privacy Commissioner of Canada. Confirm your obligations with legal counsel.

Why so much effort for one click? According to industry data cited by Insurance Business Canada (October 2025), a phishing incident costs Canadian small businesses $89,000 on average. A fast response is what keeps you far from that number.

Make the next click harmless

Nobody is immune to a click. The goal is to make sure one click is no longer enough.

• Multi-factor authentication on every account, phishing-resistant for admins and finance staff.
• A "Report" button in your email app, and a named person who handles reports.
• Alerts on new forwarding rules and unusual sign-ins.
• A one-page procedure: who to call, what to unplug, what not to delete.
• Regular refreshers built on real examples, like the ones in our guide on how to spot a phishing email.
• A review of your email security settings, as in our Microsoft 365 and Google Workspace audit.

Print the table at the top of this page and post it by the workstations. The day someone clicks, they'll know what to do in the first minute.