If money has gone, call your bank now, then come back. This page explains; it does not replace your IT help, insurer or national agency, and Moraph for Good is not an emergency service. Keep a record as you go in the incident log.
The first hour
Speed matters more than getting everything perfect. Do these in order.
Tell someone now.The person who clicked tells whoever looks after your systems straight away, by phone or in person. The NCSC’s first advice for a message received on a work device is to contact the IT department. Thank them for reporting: a quick report is the most useful thing anyone can do.
Work out what was given away.If nobody typed anything, downloaded a file or installed software, the NCSC says further action is unlikely to be needed; stay alert for unusual messages and sign-in alerts. If a password, bank details or a file were involved, carry on below.
A password was typed in: change it.Change it on the account, and on every other account that used the same password, from a device you trust (see changing passwords). Then sign that account out everywhere.
A file was opened or software installed: isolate the device.Disconnect it from the network but leave it switched on, as in our first-hour checklist. Run a full scan with your security software and let it clean up what it finds.
Bank or card details, or a payment: call the bank.Use the number on the bank’s website or your card. If money has gone, ask for the payment to be recalled. See banks and payments.
Start the log.Note the time of the click, what was entered and what you have done so far. The incident log does this in your browser and prints it.
The same day: lock the account down
The NCSC’s steps for a hacked account, in the order that keeps the attacker out.
Check mail rules and forwarding first.Attackers often set up a rule that sends them a copy of your mail, which lets them reset other passwords. Delete any you did not create before changing the password. See checking mail rules.
Change the password and sign out everywhere.Then any device or app still signed in has to use the new password.
Check recovery details, sign-in methods and connected apps.Recovery email addresses and phone numbers should be yours. Remove sign-in methods, app passwords and apps you do not recognize. Your administrator can do this for Microsoft 365 and Google Workspace accounts.
Turn on multi-factor authentication.See multi-factor authentication.
Look at what the attacker may have done.Check Sent and Deleted items for messages you did not write or that were read and deleted, and look for payment-change requests sent from the account.
Tell your contacts.If messages went out from the account, warn the people who got them to treat them with suspicion and not to act on requests for money.
Report it.Report the phishing email and, if you lost money or were hacked, the crime. See who to notify.
The incident log has these steps as checklists for email, bank, social media and cloud accounts, each with its source.
The next 24 hours
Most of the damage from a phishing click comes later, through the accounts it opened.
Watch the account.Look out for sign-in alerts you do not recognize, changes to security settings, rules that reappear and messages you did not send. These are the signs the NCSC lists.
Check the other accounts.Any account that shared the password, or that can be reset through the affected mailbox, deserves the same checks: password, sessions, recovery details, 2-step verification.
Check the bank.A hacked email account can lead to compromises elsewhere. Check statements and payment approvals for anything unusual.
Update devices.Install waiting updates on the affected device and turn on automatic updates.
Keep the log going.Add every call, reference number and decision. If personal information may have been seen, decide who assesses whether you must tell anyone (see who to notify).
Then the review
Within a couple of weeks, while memories are fresh.
- Read the log back together. What happened, in order, and what helped or slowed you down. No blame: the aim is fewer clicks next time and faster reports.
- Pick three to five changes, each with an owner and a date. Common ones: 2-step verification on every email account, a callback rule for payment changes, a clear way to report a suspicious email.
- Update your plan. The NCSC advises small organizations to have a plan that sets out who does what if something goes wrong. Use the incident plan builder, and the self-assessment to see what else to fix.
- Practise, kindly. The phishing drill kit has training examples and a briefing that reward reporting.
For the meeting itself, After an incident: a short, blameless review has a 60-minute agenda, the questions to ask and a one-page template.
What to tell staff
Calm, short, and with no names.
Tell staff the same day, briefly. Adapt this:
“Someone here received a convincing scam email today and reported it. Thank you to them: reporting quickly is exactly the right thing to do.
For the next few days, be careful with any message that seems to come from [the affected account], and with any request to change bank details or make an urgent payment. Check by phone on a number you already had.
If you think you clicked something or typed a password, tell [name] straight away, even if you are not sure. Nobody will be in trouble for reporting.”
Do not name the person who clicked, and do not share details that are still being investigated.
Who to notify
Not all of these will apply. Write down each one you contact, when, and any reference number.
- The account provider. Report that the account was compromised; the provider can offer insight into how it was accessed.
- Your bank, if bank or card details were given or money moved.
- Your insurer, if you have cyber insurance: check what the policy asks you to do and when.
- The national agency that takes incident reports (list below).
- The police or fraud reporting service if money was lost: in the United States the FBI’s IC3 (ic3.gov); in England, Wales and Northern Ireland Report Fraud (reportfraud.police.uk or 0300 123 2040), in Scotland Police Scotland on 101.
- The phishing email itself. In the United Kingdom, forward it to report@phishing.gov.uk. Elsewhere, use your email service’s report button, as CISA suggests.
- Contacts, suppliers and partners who received messages from the account, or whose information was in it.
- Regulators and the people affected, if personal information may have been seen or taken. Whether you must, and how fast, depends on the law where you are: read privacy duties, country by country and take advice. We do not summarize those duties here.
National agencies that take incident reports:
Elsewhere, contact your national computer emergency response team (CERT) or the police.
Banks and payments
Minutes matter when money has moved.
- Call the bank’s fraud line using the number on its official website or your card, never one from the message.
- If a payment went to the wrong account, the FBI’s IC3 advises asking the bank to request a recall or reversal, and a Hold Harmless Letter or Letter of Indemnity, as soon as the fraud is recognized.
- If card details were typed into a fake page, tell the bank and cancel the cards; the NCSC notes you can often do this in online banking.
- Look for payment-change requests sent from, or answered by, the affected mailbox. A real mailbox is the attacker’s best tool for redirecting an invoice.
The payment fraud toolkit has the callback rule that stops most of these frauds, and what to do in the first hours if money has gone.
Changing passwords from a clean device
A new password typed on an infected computer may be captured too.
If the click may have put something on a computer, a password typed on that computer could be captured again. Until the device has been checked and scanned, change passwords from a different device you trust, such as a phone or another computer that was not involved. The FTC’s advice is to update your security software and run a scan before you start recovering an account.
- Change the affected account first, then every account that used the same password. Criminals try a stolen password on other services.
- Use a strong, unique password; Get Cyber Safe suggests a passphrase of four or more random words and at least 15 characters.
- Do not send the new password by email: the attacker may still be reading it. Microsoft gives the same warning to administrators.
- If you use Microsoft 365, app passwords are not revoked when the password is reset; delete them and create new ones.
Multi-factor authentication
The single change that makes a stolen password much less useful.
- Turn on 2-step verification (also called multi-factor authentication or 2FA) for the affected account, then for every email and banking account. Even if a criminal knows the password, they cannot get in without the second step.
- Where your email provider supports passkeys, the NCSC now recommends enabling them for staff accounts as a priority.
- Check the second-step methods already on the account. Microsoft advises removing any sign-in method or device you do not recognize: an attacker may have added their own.
- For administrators, Google recommends security keys over codes for better protection against phishing.
Checking mail rules and forwarding
The attacker’s favorite way to stay in after you change the password.
Look in the mail settings for rules and forwarding. On a business account, ask your administrator to check too: some settings are visible only to administrators. Microsoft lists these as signs of a compromised mailbox:
- Rules that forward mail automatically to addresses you do not know.
- Rules that move messages to rarely opened folders (such as Notes, Junk Email or RSS Subscriptions), so you never see the replies.
- Recently added forwarding to an outside address.
- Unexplained messages in Sent or Deleted items, missing mail, or a changed email signature.
Note what you find in the log, with a screenshot, before you delete it.
Preserving evidence
Insurers, agencies and investigators may ask for it later.
- Keep the phishing email: do not delete it. Save it, with its full headers if you can, and report it.
- Take screenshots of rules, sign-in alerts and anything odd, with the time.
- Leave affected computers switched on but off the network. The FTC tells businesses to take affected equipment offline but not to turn machines off until forensic experts arrive, and not to destroy evidence.
- Keep payment confirmations, invoices, call notes and reference numbers together, and write down where they are in the log.