Network and security
A colleague clicked a phishing link: what do you do now?
Short answer
Change the account password at once, sign out every device and check whether forwarding rules or new sign-in methods were added. Only clicking is rarely a disaster; typing in details or opening an attachment is. Ask the colleague exactly what happened, without blame, because speed depends on honest reporting. If personal data was accessed, assess whether you must report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
What exactly happened?
That is the first question, and the answer decides everything that follows. There are four grades.
| What the colleague did | Risk | What you do |
|---|---|---|
| Opened the mail, did not click | None | Delete the mail, warn colleagues |
| Clicked the link, entered nothing | Small | Report it, have the device checked if in doubt |
| Entered a password or code | High | All the steps below, straight away |
| Opened an attachment or installed something | High | Take the device off the network, have it investigated |
Ask without blame. Someone who is afraid of the reaction reports it a day later or not at all. That day is the difference between a changed password and an emptied mailbox.
What do you do straight away?
If details were entered, in this order:
- Change the password. From another device, and for every other account where the same password was used.
- Sign out all sessions. An attacker who is already signed in otherwise stays signed in after the password change.
- Check the sign-in methods. Has a phone number or app been added that is not the colleague’s? Attackers do that first, to keep access.
- Look at forwarding rules. A rule that quietly forwards all incoming mail to an external address, or moves mail containing the word “invoice” to a hidden folder. This is the classic trace.
- Look at what was sent. The account is often used to send the same phishing mail to all contacts. If so, warn those contacts.
If an attachment was opened, take the device off the network (switch off wifi, pull the cable) and leave it on. Switching it off wipes traces that are needed to see what happened.
What do you check afterwards?
Whether the attacker saw or did anything. In Microsoft 365 you can trace which locations and devices signed in, and which files and mailboxes were opened. Those logs are kept for a limited time, so do this in the first days.
The questions you want answered:
- Did anyone sign in from a place or device that is not the colleague’s?
- Were any mails read, forwarded or deleted?
- Were any files downloaded from OneDrive or SharePoint?
- Was any app or connection given permission on the account?
If that shows that someone else had access to personal data, you have a data breach. You have to record and assess it, and in some cases report it.
When does it turn into invoice fraud?
When the attacker steals nothing but reads along. He waits for an invoice in progress, then sends a message from the real account or an almost identical address saying the bank account number has changed, and the customer pays the wrong party.
This is the most expensive outcome of a successful phishing mail, and it often only comes to light weeks later. That is why checking forwarding rules and sign-in attempts is not a formality.
How do you prevent the next one?
Not by telling people to pay more attention. Phishing mails have become good enough that everyone falls for one sooner or later, us included. You set things up so that one click is not enough.
- Two-step verification for everyone, no exceptions. The exception is always the director, and the director is the target.
- Sign in only from known devices. A stolen password then does not work on the attacker’s laptop.
- Switch off automatic forwarding to outside addresses. It closes off the most used trace.
- Filtering on the network. DNS filtering blocks known phishing addresses before the page loads.
- Protect your own domain. With SPF, DKIM and DMARC nobody can send mail in your name.
- An agreement on payments. A changed bank account number is always confirmed through a second channel.
These are settings, not courses. We configure them under Microsoft 365 security and include them in cybersecurity for small and medium-sized businesses.