CYBER SECURITY
What should a business do after a phishing email is reported?
Confirm whether any link was clicked or information entered, secure the affected account if needed, check whether the email reached other staff, and use the report to reinforce awareness rather than assign blame.
First, establish what actually happened
Ask whether any link was clicked, any attachment opened, or any username or password entered on a linked page. This determines whether the response is a quiet review or an active account-security step.
If credentials may have been entered
- Change the password for the affected account immediately
- Confirm multi-factor authentication is active on that account
- Check recent sign-in activity for anything unfamiliar
- Review whether the account has access to other systems that should also be checked
Check whether the email reached others
The same phishing email is often sent to multiple people in an organisation. Checking whether others received it, and alerting staff to watch for it, limits the impact of a single report.
Treat the report as useful, not a mistake
A staff member reporting a suspicious email is a good outcome. Responding calmly and without blame encourages people to keep reporting, which is one of the more effective everyday defences against phishing.
RELATED QUESTIONS
Frequently asked questions.
Should every suspicious email be reported, even if unsure?
Yes. It is far more useful for staff to report anything uncertain than to guess and stay quiet, since even a false alarm takes little time to check.
Is antivirus software enough to stop phishing?
No single control stops every phishing attempt. Email filtering, multi-factor authentication and staff awareness all play a part alongside endpoint security.