"I Clicked It": What to Do in the First 5 Minutes After a Phishing Attack
It happens to plenty of careful people. You're busy, an "urgent" email arrives about a missed delivery or a password reset, and you click before you look. A moment later you notice the address looks wrong, or the page is asking for something it shouldn't.
A calm first response matters more than a perfect one. What helps most is acting in a clear order, so here's a practical sequence for the first five minutes.
Minute 1: Sever the Connection
As soon as you realise something's wrong, cut the device's connection so the page can't keep talking to it.
On a laptop, cut the network. Turn off the Wi-Fi or unplug the Ethernet cable.
On a phone, go offline. Open Settings and switch on Airplane Mode.
Why going offline helps. Disconnecting can stop malicious software calling out, limit data leaving the device, and may interrupt anything that has already started running.
Minute 2: Stop Entering Data
Close the page cleanly. Close the browser tab or force-close the app. Don't use the Back or Cancel buttons on that page.
Stop if you've started typing. If you've begun entering a password or a card number, stop there. Some phishing pages record what you type before you press submit.
Minute 3: Change Your Passwords (from a DIFFERENT device)
Use a different device for the password change. Change your passwords on another phone or computer you trust, not on the device that opened the link.
Start with email. Begin with your main email account, because it's used to reset other accounts, then move on to banking and the social accounts that matter.
Turn on MFA if it's missing. If it isn't already on, switch on Multi-Factor Authentication (MFA), a second check such as a code on your phone, while you're changing those passwords.
Minute 4: Scan for "Sleepers"
Run a full malware scan. With the device still offline, run a Full System Scan using antivirus software you trust. A quick scan may miss programs hiding in temporary folders or scheduled tasks.
Check the Downloads folder. Open Downloads and delete anything you don't recognise that the click may have saved.
Minute 5: Report and Monitor
Call your bank if you typed payment details. If you entered financial details, ring your bank's fraud team straight away.
Report the email. Forward the original email to the organisation being impersonated (for example Netflix or HMRC) and to the UK reporting address [email protected].
Need an Expert Security Audit?
If you've clicked a link and aren't sure the device is clean, bring it in rather than guessing. At LaunchLayer, our virus and scam clean-up is a fixed £69. We can scan the system, remove hidden trackers, and help you secure your accounts.
Drop-off at the workshop is by appointment. Call 07367 652987 or send a message and we'll confirm a time and the address. Collection and return are free in SS11 and SS12. If you're further out, collection is by arrangement. You can also book our £60 laptop MOT. ️