I clicked a suspicious link or opened an attachment: what now

It happens to everyone, even careful people. Phishing is designed to fool you. What matters most is acting quickly and letting us know, so the problem stays small.

First, figure out what happened

• You only clicked a link and closed the page: the risk is usually low, but still follow steps 4 and 5 below.
• You typed your password or a code on the page: assume your account is at risk and follow all the steps, starting with step 2.
• You downloaded or opened a file, or allowed a program to run: start with step 1.

Step by step

1. If you downloaded or opened something, disconnect. Unplug the network cable and turn off Wi-Fi on that computer. Don't shut it down, and don't keep using it until we've checked it.
2. Change your password from a different device. Use another computer or your phone, not the one that might be infected. For Microsoft 365, sign in at office.com, click your picture or initials, choose View account, then Password > Change password. Use a new, unique passphrase.
3. Change it anywhere else you used the same password. If you reused that password on other sites, change those too, starting with banking and email.
4. Check your multi-factor authentication (MFA). Go to mysignins.microsoft.com/security-info and look at the list of sign-in methods. If you see a phone number or Authenticator app that isn't yours, don't delete it yourself; tell us right away. Also check Recent activity on the same site for sign-ins you don't recognize.
5. Notify us. Open a ticket at support.elitechforce.com or email [email protected] from a safe device. Tell us what you clicked or opened, roughly when, and whether you entered a password or code.
6. Keep the original email. Don't delete it. It helps us check whether others in your organization received the same message. You can use the Report button in Outlook after we've seen it.

Watch for these signs in the next few days

• Coworkers or clients receive emails from you that you didn't send.
• Sent items, rules or forwarding settings in Outlook that you didn't create.
• MFA requests on your phone that you didn't start. Always deny them.
• Password reset emails you didn't request.
• Unusual charges, if you entered payment information.

If you entered credit card or bank details, call your bank using the number on the back of your card or on its official website.

Don't be embarrassed

Reporting a mistake quickly is the right thing to do, and it's far better than staying quiet. Attackers count on people hiding what happened. The sooner we know, the more we can do to protect you, your coworkers and your clients. We won't judge you; we'll help you fix it.