Someone Clicked the Link: What Your Business Should Do in the First Hour

Employee and colleague reviewing a suspicious email at an office desk

A staff member reports that they clicked a suspicious email link. Or they are not sure whether they clicked it. What should the owner or office manager do next?

The answer is not “delete the email and move on.” It is also not “reboot the computer and hope nothing happened.”

Treat the situation as a potential business risk event. A successful phishing attempt can affect revenue, client information, email accounts, payment instructions, operational systems, and your reputation. The goal during the first hour is to identify the risk, limit the potential impact, preserve evidence, and begin monitoring.

Here is the practical first-hour response.

“What should we do first?”

1. Tell the employee to stop interacting with the message

Ask the employee to stop clicking, replying, downloading files, entering information, or approving unexpected MFA prompts.

Do not ask them to investigate the link themselves. Do not have them forward the suspicious message to coworkers. Additional interaction can create more risk or alter important evidence.

Ask the employee for the basic facts:

  • What time did they open the email?
  • Did they click the link?
  • Did a webpage open?
  • Did they enter a username, password, payment information, or MFA code?
  • Did they download or open a file?
  • Did they approve an unexpected login or MFA request?
  • Did anything unusual happen afterward?

If the employee is unsure whether they clicked, treat the event as a potential click until your IT or security provider can investigate.

2. Notify the right people immediately

Notify your internal IT contact, managed IT provider, cybersecurity provider, or incident-response specialist. If your company has no technical support relationship, contact a qualified cybersecurity professional immediately.

The owner or office manager should also be informed. This is not just an IT ticket because the potential consequences may involve:

  • Client or employee data
  • Access to email and cloud applications
  • Payroll or financial systems
  • Vendor payment instructions
  • Confidential business information
  • Regulatory or contractual obligations
  • Cyber-insurance notification requirements

If the employee’s email account is used to communicate with customers, vendors, or financial institutions, the business may need to watch for fraudulent messages sent from that account.

Speed matters because an attacker may be attempting to use stolen credentials while everyone is still deciding what to do. Early containment can prevent a suspicious click from becoming an account takeover or a broader business disruption.

Office manager calling an IT professional while an employee reports a suspicious email

“Should we disconnect the computer or leave it on?”

In most cases, disconnect the affected computer from the business network while keeping it powered on.

That usually means:

  • Unplug the Ethernet cable, if applicable
  • Turn off Wi-Fi
  • Disconnect from the VPN
  • Do not connect the device to another network
  • Leave the computer powered on unless your IT or security provider instructs you otherwise

Disconnecting limits the computer’s ability to communicate with external systems or access shared business resources. Keeping it powered on may preserve useful information, such as running processes, active connections, memory contents, browser activity, and security alerts.

Do not reboot the computer simply to make the problem disappear. Rebooting may remove valuable evidence, terminate useful investigative information, or allow certain malicious activity to restart in a less visible way.

Do not start deleting files, clearing browser history, uninstalling applications, or running random cleanup tools. Those actions can make it harder for a professional to determine what happened.

If the device is showing severe or unusual behavior (such as repeated login prompts, unexpected remote-control activity, or rapid file changes) tell your IT or security provider immediately and follow their instructions.

“Should we delete the email?”

No. Preserve the original email.

The message itself is evidence. It may contain information needed to identify the sender, malicious infrastructure, affected users, and the type of attack. Important details can include:

  • Full email headers
  • Sender address and reply-to address
  • Original subject line
  • Links and redirect URLs
  • Attachments
  • Delivery time
  • Authentication results
  • The exact webpage or login prompt shown

Do not rely only on a screenshot. Screenshots can help, but they do not preserve all of the technical information that may be needed for investigation.

Ask your IT or security provider to preserve the message in a secure location or export it with its original headers. If your email platform has a built-in phishing report function, use it only after the evidence has been preserved or as directed by your provider.

Afterward, the message may need to be removed from other mailboxes and blocked across the organization. That is a containment step, not a reason to destroy the original evidence.

“Should we change the employee’s password right away?”

Not from the potentially affected computer.

Changing a password may be necessary, but doing it too early or from a compromised device can be ineffective. If malware, a malicious browser extension, or an information-stealing process is present, the new password could also be captured. If an attacker already stole a browser session, changing the password alone may not invalidate that session.

The better sequence is:

  1. Have IT or a security provider lock or restrict the account if appropriate.
  2. Revoke active sessions and authentication tokens.
  3. Revoke suspicious OAuth permissions, application passwords, or connected applications.
  4. Investigate the computer and account.
  5. Reset the password from a known-clean device.
  6. Confirm MFA is enabled and functioning.
  7. Review the account for unauthorized changes.

The exact order may vary depending on the environment. In a cloud email system, session revocation and account containment may be more urgent than a simple password change.

“What credentials or access could be at risk?”

A phishing link does not always attempt to steal only the employee’s email password. Depending on what happened, the risk may include:

  • Email credentials
  • Browser session cookies
  • Cloud application sessions
  • OAuth tokens
  • Saved browser passwords
  • VPN credentials
  • Remote desktop access
  • Accounting or payroll logins
  • Customer relationship management systems
  • File-sharing platforms
  • Administrator credentials
  • MFA codes or approval requests

An employee may have entered credentials without realizing the page was fake. They may also have clicked a link that silently attempted to collect browser or device information.

Your IT or security provider should review sign-in activity for unusual locations, devices, times, and authentication methods. They should also check for:

  • New mailbox forwarding rules
  • Auto-delete or auto-move rules
  • Suspicious delegated access
  • New applications connected to the account
  • Unfamiliar MFA devices
  • Messages sent from the account
  • Attempts to access other users or systems

Laptop isolated from the network while remaining powered on during incident response

“What should we document for cyber insurance?”

Start an incident record as soon as the report is received. Do not wait until you know whether the event is serious.

Record:

  • Date and time the employee reported the issue
  • Approximate time of the click or suspected click
  • Employee name, email address, and device name
  • Email subject, sender, and recipient
  • What the employee clicked
  • Whether credentials, MFA codes, or other information were entered
  • Whether a file was downloaded or opened
  • Systems the employee can access
  • Names of people notified
  • Time each containment action occurred
  • Who performed each action
  • What evidence was preserved
  • Any suspected financial, operational, or data impact

Document actions in time order. For example:

  • 9:08 a.m., Employee reported suspicious email.
  • 9:12 a.m., Laptop disconnected from Wi-Fi and VPN.
  • 9:18 a.m., Account sessions revoked by IT provider.
  • 9:27 a.m., Original email preserved with headers.
  • 9:40 a.m., Sign-in logs reviewed; investigation ongoing.

This record helps your technical team, leadership, legal counsel, insurer, and possibly law enforcement understand what happened. It also helps demonstrate that the business responded promptly and responsibly.

Review your cyber-liability policy or contact your broker for the required notification process. Some policies require prompt notice, use of an approved incident-response provider, or coordination through a breach hotline. Do not delay notification while waiting for absolute certainty if your policy requires early reporting.

If the event may involve fraudulent payment instructions or a transfer of funds, contact the bank or payment processor immediately. If personal, financial, health, or regulated information may be involved, flag that possibility for legal and compliance review.

Business owner and IT advisor documenting an incident timeline at a conference table

“What should we monitor after the first hour?”

The first hour is containment, not closure.

Continue monitoring:

  • Email sign-ins and authentication alerts
  • Outbound messages from the affected account
  • Mailbox forwarding and deletion rules
  • Cloud application activity
  • Endpoint security alerts
  • VPN and remote-access logs
  • Other employees who received the same message
  • Customer or vendor reports of suspicious messages
  • Financial accounts and payment requests

If the message reached multiple employees, identify every recipient and determine whether anyone else clicked, entered information, or downloaded a file.

Your team should also determine the business impact:

  • Was any client information accessible?
  • Was the affected user authorized to approve payments?
  • Could the account access shared files?
  • Did the attacker send messages to customers or vendors?
  • Was any sensitive information downloaded?
  • Is there evidence of unauthorized access?

This is the Business Risk Advisor perspective: identify the exposure, quantify the potential impact, mitigate the immediate risk, and monitor for further activity.

For additional guidance on phishing response and small-business protections, review the B&R Computers Resources hub. If your business does not have a documented response process, a Business Risk Review can help identify where response responsibilities, technical controls, and insurance requirements need to be strengthened.

The first-hour checklist

If an employee clicked a suspicious link, or is not sure whether they did:

  1. Stop interacting with the email and webpage.
  2. Notify the owner, office manager, and IT or security provider.
  3. Disconnect the computer from the network, but keep it powered on.
  4. Preserve the original email and technical details.
  5. Lock the account and revoke sessions or tokens as directed.
  6. Reset passwords from a known-clean device after containment.
  7. Review email, cloud, endpoint, and authentication activity.
  8. Document the incident and every response action.
  9. Check cyber-insurance notification requirements.
  10. Continue monitoring for account misuse, fraud, and data exposure.

The goal is not to assign blame to the employee. The goal is to make the next decision quickly and accurately. Employees should be encouraged to report suspicious clicks immediately because early reporting gives the business more options.

If you want to know how prepared your business is before an incident occurs, contact B&R Computers for a Business Review or free IT Risk Review. We can help you evaluate your current exposure, response process, monitoring, and cybersecurity controls before a suspicious email becomes a larger business problem.