Five Mistakes People Make in the First Hour After Clicking a Phishing Link

You clicked it. Maybe you typed your password, maybe you stopped at the login box, maybe you only opened the page and closed it. Whatever happened, you are now in the most important sixty minutes of the whole incident, and almost nobody spends them well. The mistakes below are not stupid mistakes. They are the natural, human reactions to embarrassment and adrenaline, and they are exactly the reactions that give an attacker room to work.

Mistake 1: Going Quiet While You Decide What to Do

The first instinct is to sit with it. You tell yourself you'll work out whether it was really a phishing page before you tell anyone, because telling someone means admitting you fell for it.

That pause is the whole problem. If your credentials were captured, they are often being used within minutes — to log in, to read mail, to add a forwarding rule, to look for anything financial. Nobody on a security or IT team expects employees to be flawless. They expect a fast report. A five-minute report is a manageable event. A two-day report is a breach investigation.

If it's a work device or work account, tell IT or whoever handles security as soon as you can, before you start changing things. If it's personal, tell someone you trust who can stay calm and help you work through the list below.

Mistake 2: Changing Passwords in the Wrong Order

The second instinct is to change everything, everywhere, immediately — often starting with whichever account is open in the browser or the one you actually handed over.

That's backwards. The account that matters most is your email, because it is the master key to everything else. Password resets, verification links, receipts, and account recovery all route through it. If someone has your mail, they can reset a lot of other things whether or not they know those passwords.

Email first, then the password manager, then money

• Change your email password, then check its settings: forwarding rules, filters, recovery address and recovery phone number, and any devices or apps still signed in.
• Change the password on your password manager from a different, clean device — then rotate the vault if it offers that option.
• Change anything whose credentials you typed into the page, and anything that shared the same password.
• Banking, payment and shopping accounts after that, checking recent transactions rather than just changing the password.

One more detail people skip: don't do all of this on the same device you just used to click the link, at least not until you're reasonably sure the device is clean. Borrow a phone or another computer.

Mistake 3: Assuming a New Password Ends the Attacker's Access

Changing a password does not necessarily kick anyone out. Most services keep you signed in on existing devices, and active sessions can survive a password change, sometimes for weeks.

After you change a password, look for the option usually labelled something like "sign out of all devices" or "log out everywhere". Then check the security settings for:

• Trusted or remembered devices you don't recognise
• App passwords or legacy mail-app logins that bypass the main password
• Connected apps and third-party access you didn't grant, or granted years ago and forgot
• Multi-factor methods you didn't set up, and recovery codes you didn't generate

If you spot a session or device you can't explain, remove it before you do anything else. It's the difference between locking the door and just changing the lock while someone is still in the hallway.

Mistake 4: Poking at the Link Instead of Leaving It Alone

Curiosity is expensive here. People reopen the page to check whether it was genuine, download the attachment to see what it does, or forward the link to a colleague asking "does this look right to you?"

Don't forward the link. You'll spread it — and if your colleague clicks, you've created a second incident while you were trying to solve the first. Don't re-enter anything on the page to "test" it; the page is a trap, not a puzzle. And if you opened a file, close it and assume the device needs checking rather than pretending it didn't happen.

What you should capture instead: a screenshot, the full URL, the sender's address, and the approximate time. That is the evidence another person needs to block the campaign and warn others.

Mistake 5: Treating a Clean Antivirus Scan as the Finish Line

Most phishing doesn't install anything. The entire attack can be a page that collects what you type and quietly sends it off. A virus scan on a computer that has nothing wrong with it returns nothing, and that empty result feels like an all-clear. It isn't.

The same goes for the toolkit instinct — downloading a "cleaner" or a "remover" someone recommended in a forum. You're adding unknown software at the moment you're least able to judge it. If the page convinced you to run a downloaded file, treat the machine as compromised: on a work device, hand it to IT and don't wipe it yourself; on a personal machine, change your passwords from a different device first, then do a full scan and review what was installed, what browser extensions appeared, and what changed in your browser settings.

The Order That Actually Works

If you clicked minutes ago, work through this in sequence. It takes less time than reading about it.

1. Disconnect. Turn off Wi-Fi, unplug the network cable, and don't start deleting things.
2. Write down what happened: the URL, the time, what you entered, anything you downloaded.
3. Switch to a clean device for everything that follows.
4. Secure your email, then revoke sessions and unknown devices, then check forwarding and recovery settings.
5. Change the password for any account you typed credentials into, plus anything reusing that password.
6. Turn on multi-factor authentication, and prefer an authenticator app or a hardware key over codes by text message where the service offers it.
7. Check money: recent transactions, saved cards, standing orders. If bank details were entered, call your bank's number from its own website or your card, not from the message you received. For anything with financial or legal consequences, speak to your bank or a qualified professional rather than relying on general advice.
8. Report it: IT or security for work accounts, and a short heads-up to family, friends or clients who might receive the same message from your name.
9. Only then deal with the device itself — a full scan, a review of extensions and settings, and for work machines, whatever your IT team asks.

What to Do After the First Hour

Keep watching for a few days. Unusual password reset emails, alerts about new sign-ins, messages from contacts about links you didn't send, or a card charge you don't recognise are all worth checking immediately rather than noting for later. If you turned on multi-factor authentication too late, review whether any new method was added during that window.

The most useful habit to have in place before this ever happens is knowing who to tell and how — a reporting address at work, a password manager on your phone, and one trusted person who will help without making you feel foolish. The click itself is a moment. The hour after it is a choice, and almost everyone who handles it well does the same boring things in the same order.

Photo: nvtrlab / Pixabay