Guides · Cybersecurity · Phishing
Suspicious Link: What to Do in the First 20 Minutes
A click, a password typed in and a file opened call for three different responses. Work out what happened, preserve the evidence, then protect the device or account concerned.
The short answer
After clicking a suspicious link, start by describing exactly what happened next. Did the page just load? Did you type a password or bank details? Was a file downloaded, opened or run? That distinction decides which action helps.
If the page only loaded, close it and keep the message, the link’s address and the time of the click. If you typed a password, use a clean device to change that password everywhere it was reused, revoke open sessions and check the recovery methods, multi-factor authentication, authorized apps and email forwarding rules.
If you opened a file, installed a program or saw unusual behavior, disconnect the device from Wi-Fi, the network cable, Bluetooth and shared media. Leave it powered on, stop using it and tell whoever manages IT right away. Were payment details sent? Call the bank too, without delay.
In every case, report the incident quickly with precise facts. An early alert makes it possible to check logins, warn the recipients of a fraudulent message and measure any data exposure.
State what happened after the click
The seriousness depends less on the click than on what the page or file obtained afterward. Note what you did, without going back to the link: page displayed, information entered, document downloaded, file opened, permission granted or program installed.
| What happened | Main risk | First action |
|---|---|---|
| The page loaded, with nothing typed and no file opened | Limited information gathering, or an interrupted attempt | Close the page, keep the message and report the link |
| A password or a code was entered | Takeover of the account and of linked accounts | Handle the account from a clean device |
| Bank details were entered | Fraudulent payment or use | Call the bank, then keep and report the facts |
| A file was opened or a program installed | Compromise of the device and access to the network | Isolate the device and alert the IT team |
Keep the message and the exact address
Keep the email, text or original message. Take a screenshot of the page if it is still visible, then note the time of the click and the information you submitted. Copy the link’s address without opening it a second time.
In a company, send these items through the channel set up for incidents. When the IT team asks, attach the original message rather than forwarding it: its technical information then stays available for analysis.
What not to do
- Deleting the message before it has been analyzed
- Reopening the link to check how it looks
- Replying to the sender or calling them using the details in the message
- Forwarding the alert to all your colleagues with the link still active
Isolate the device if a file was opened
A downloaded file that was never opened can be deleted once reported. An opened file, an allowed macro, an installed extension or a launched program changes the priority: cut the network connections and shared media to limit exchanges with the outside and with other devices.
Leave the device powered on and stop using it. The IT department may need its current state to understand what ran. Use another trusted device to communicate and to protect your accounts.
What not to do
- Shutting down or resetting the device before getting instructions from IT
- Running several cleanup tools that alter the evidence
- Plugging in a USB drive to copy documents
- Continuing to open email, banking or company tools
Close every door into the account
From a clean device, start with your email if it is used to recover your other accounts. Create a unique password, then change the password on every account where you reused it.
The new password closes one door, but a session, an authorized app or a forwarding rule may stay active. For Microsoft 365 or Google Workspace, ask the administrator to check all the access tied to the account.
- Revoke sessions. Every device must ask for authentication again.
- Check MFA. Remove unknown devices, numbers and verification methods.
- Verify recovery. Confirm the addresses and numbers used to regain the account.
- Remove unknown apps. Revoke their permissions and access tokens.
- Read the email rules. Delete unknown forwards, redirects and automatic deletions.
Report these five facts
Send the time, the channel it came through, the link’s address, the information entered and the action taken on the device. Add any unexpected MFA approval, any message sent from your account or any unknown login.
The administrator can then search the logins, suspend the account, warn the recipients of a fraudulent message and check the other targeted accounts. Your report is worth more when it arrives early and clearly separates facts from assumptions.
Subject: click on a suspicious link at [time]
Message received by: [email / text / other]
Address displayed: [full address]
Action taken: [page opened / password entered / file opened]
Information submitted: [precise list]
Device concerned: [name or model]
Measure already taken: [network cut / password changed / bank called]Measure what the account or device exposed
Check the logins, the messages sent, the files viewed and the actions taken from the account. If the device joined the company network after the file was opened, also check the services it could reach.
Could personal data have been read, copied, altered or deleted? Open an incident timeline and have the notification obligations assessed. Any 72-hour deadline is handled in a separate procedure, counted from the moment you become aware of the breach.
What to ask your IT department
Have all the sessions, tokens and authorized apps on my account been checked?
The list of access revoked, apps reviewed and anomalies found.
Were any forwarding or deletion rules added to my mailbox?
A check of visible and hidden rules, with the details of any rule deleted.
Which logins and actions were recorded around the time of the click?
The times, locations, devices and operations actually observed in the logs.
Did the file that was opened communicate with other devices or services?
The scope checked, the indicators searched for and the result of the analysis.
Could personal data have been viewed, altered or extracted?
The data and people concerned, the possible consequences and the documented decision on notification.
Sources
- Cybermalveillance.gouv.fr — Hameçonnage, fiche mise à jour le 7 mai 2026 (Phishing, fact sheet updated May 7, 2026)
The right moves depending on the information submitted: passwords, bank details, evidence, police report and reporting.
- Cybermalveillance.gouv.fr — Consignes aux collaborateurs en cas de cyberattaque (Instructions for employees during a cyberattack)
Disconnect the device, leave it on, stop using it and alert the IT department.
- Microsoft Learn — Responding to a compromised email account in Microsoft 365
The checks that complement the password: sessions, MFA, consents, roles and mailbox rules.
- Google Workspace — Identify and secure compromised accounts
Suspension, activity review and revocation of OAuth tokens.