If you’re asking “employee clicked phishing link what to do,” start by reporting it promptly to your IT contact or designated incident lead. A click is a warning sign, not proof that malware ran or credentials were stolen. The next steps depend on what happened after the link opened, so focus on getting a clear account of the incident and limiting potential damage.
Ask the employee to report what they saw and did without embarrassment or blame. A quick, candid report helps your team respond while relevant details are still available. The NIST phishing guidance for small businesses also emphasizes reporting suspicious messages and suspected phishing activity.
Start with what the employee did
Clarify whether the employee only opened the link, entered a password or other information, downloaded or opened a file, approved an authentication request, or shared financial details. Ask whether they saw an unfamiliar sign-in prompt, security warning, or unexpected activity afterward. Record the time as best you can, which device and account were involved, and any actions taken since.
Keep the original message if possible. Do not forward it casually or click the link again to investigate. Preserve the sender details, subject, link destination if it is visible without opening it, and any screenshots or alerts. Share these with your IT contact through an approved channel.
Contain a potentially affected device with IT guidance
If a file was downloaded or run, the device showed unusual behavior, or your security tools raised an alert, contact IT immediately. Do not assume that every link click infected the computer. A visit to a phishing page, by itself, does not confirm that malicious software installed or ran.
Ask IT whether the device should be disconnected from the company network or otherwise isolated. Follow your organization’s incident procedures rather than making changes that could interrupt investigation or affect other systems. The CISA phishing guidance can help organizations think through ways to stop an attack and respond to suspected phishing.
If you do not have internal IT staff, contact a qualified support or incident-response professional. Avoid using a potentially affected device to change sensitive passwords until IT advises you on a safe approach.
Secure accounts if information was entered or access was approved
If the employee entered a work password, shared a verification code, or approved an authentication request they did not initiate, treat the account as potentially exposed. Contact IT promptly. From a device IT considers safe, change the affected password and any other password that was reused. Have IT review active sessions and revoke them where appropriate, and check that multifactor authentication methods and recovery details still belong to the employee.
Changing a password is an important containment step, but it is not the whole investigation. Someone who accessed an account may have changed settings or created another way to get back in. IT should review the account for unfamiliar sign-ins, changes to recovery information, added authentication methods, connected apps or permissions, and new forwarding or inbox rules.
For a work email account, also check sent and deleted messages, mail rules, delegates, and unexpected replies or requests sent in the employee’s name. Look for messages that may have been used to target coworkers, customers, or suppliers. If the account handles invoices or payment instructions, check whether those instructions or related communications were altered.
Check what may have been exposed
Once immediate containment is underway, identify which systems and information the employee could access. Consider email, cloud storage, business applications, shared files, customer records, and financial workflows. Look for unusual access, downloads, account changes, or messages sent from the account. Review available security alerts and logs, and preserve relevant records for the investigation.
If financial information was shared or payment instructions may have been changed, contact your bank through a trusted number or channel and act promptly. The FBI Internet Crime Complaint Center’s business email compromise guidance is relevant when an incident involves suspected payment redirection or business email fraud.
Do not assume that customers or regulators must, or must not, be notified based only on the fact that someone clicked a link. First determine what information or systems may have been accessed. Notification obligations can depend on the information involved, your industry, and where affected people are located. Consult qualified legal counsel or an incident-response professional about your situation.
Make the response repeatable
After the immediate risk is addressed, document what happened, what was checked, and what remains uncertain. Use the incident to review how employees report suspicious messages, how account access is protected, and whether your backup and continuity plans cover a disruption. For additional background, see Zevonix’s guidance on compliance support for small businesses and proactive IT monitoring.
For a business without an in-house response team, outside IT support can help investigate account activity, contain affected systems, and restore normal access. Zevonix provides managed IT, cybersecurity, and help desk services, including remote and onsite support, to businesses across the United States. Its help desk is available around the clock. To discuss an active incident or support needs, call (904) 658-0777.
Frequently asked questions
Does clicking a phishing link mean the computer is infected?
No. A click alone does not prove that malware ran or that an account was accessed. The risk depends on what happened next, including whether a file was opened, information was entered, or an authentication request was approved.
Should we disconnect the employee’s computer from the network?
Contact IT promptly and follow your incident procedures. IT can decide whether isolation is appropriate based on the signs of compromise and the need to preserve evidence. If you have no internal IT contact, seek qualified support rather than guessing.
What if the employee entered a password?
Tell IT and treat the account as potentially exposed. Change the password from a device considered safe, review active sessions and authentication methods, and investigate account activity and settings. Change reused passwords on other accounts as well.
Should we report the incident or notify customers?
Reporting depends on what happened. Consider contacting the appropriate official channel if you suspect fraud or financial loss, and consult qualified legal or incident-response help to assess possible notification obligations. Do not decide based on the click alone.
Respond promptly, then verify
A calm response starts with a prompt report, a clear record of what the employee did, and containment tailored to the exposure. Secure affected accounts, investigate suspicious activity, and get expert help when the scope is unclear. If your business needs support assessing a phishing incident, contact Zevonix at (904) 658-0777.