Someone clicked a phishing link. What do we do now?

Speed matters far more than blame here, and the person who clicked needs to feel able to say so within minutes rather than hiding it until the afternoon. That culture is worth more than any technical control.

What to do right away:

• Change their password, from a different device. If the machine is compromised, changing it on that machine hands over the new one too.
• Tell us immediately. We revoke active sessions, which matters because an attacker who already signed in stays signed in even after a password change unless sessions are killed.
• Do not delete the email. It tells us what the attack was and lets us find who else received it.
• If they entered card or banking details, call the bank as well.

What we check: mailbox rules created in the last few days, forwarding to external addresses, multi factor settings changed, sign-ins from unexpected places, and whether the same message reached anyone else.

Clicking a link and going no further is often harmless. Entering credentials is not. Either way, tell us. We would rather check twenty false alarms than miss the one that mattered.