Checklist · Response

Suspected phishing: for staff and for IT

What a reporter should do, and what IT should check when someone clicked, opened or typed a password.

Owner: Employee, then security or ITTime: 15 to 45 min

0 of 18

For the person who received it

Do not click, reply, open attachments or forward it to colleagues.
Report it with the report button, or forward it as an attachment to the security mailbox.
If you clicked or opened something, say so straight away; the help is the same and speed matters.
If you typed a password, change it from a different, trusted device and tell IT.
If you approved an unexpected MFA prompt, tell IT immediately, because someone else has your password.

Collect the full message headers, the sender, the links and the attachment hashes.
Check the link and file in a sandbox or reputation service, not on a normal workstation.
Search all mailboxes for the same sender, subject, link or attachment to find who else received it.
Record who reported, who clicked, and who entered credentials.

Delete or quarantine the message from every mailbox.
Block the sender, domain and URLs at the mail gateway, web proxy and DNS filter.
For anyone who entered credentials: reset the password, revoke all sessions and tokens, and review their MFA methods.
Check the account for new inbox rules, forwarding addresses, new app consents and mail sent in the last hours.
For anyone who opened an attachment: isolate the device, run an EDR scan, and look for new processes and persistence.

Tell the reporter what happened; a reply keeps people reporting.
If a mailbox sent mail as the user, warn recipients and any customers affected.
If money or personal data was involved, start the incident process and involve legal.
Use the message in the next awareness exercise.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed.

14-day free trial. No credit card. Cloud or on-premises.