What to do after clicking a suspicious link

Imagine you open what looks like a supplier's invoice. The page asks you to sign in. After entering your password, you notice the address looks wrong.

The next useful step is to stop and tell the person responsible for your business technology. You do not need to work out the entire incident before asking for help.

A suspicious click is a reason to investigate. It does not tell you, by itself, whether information was stolen or a device was infected. What happened after the click helps determine the response.

This week, we practiced checking requests and payment changes. Today, we will prepare for the moment when someone says, “I think I clicked something I should not have.”

Stop interacting and contact a trusted person

Stop entering information, approving prompts, downloading files, or following the sender's instructions. Close the suspicious page if you can do so normally.

Contact your owner, designated incident contact, or trusted IT provider using contact details already on file. An incident is an event that may affect the security of your business's systems or information.

If the affected email account might be exposed, use a separate trusted channel, such as a phone call. Do not rely on that same mailbox to coordinate its recovery.

Ignore offers of help inside the suspicious page. The FTC warns that fake security pop-ups and supposed support calls can be part of a scam. FTC: Tech support scams.

A useful first report is simple:

“At about 10:15, I opened a message on the front-desk laptop and entered my work email password on the linked page. I stopped and am calling from my phone.”

That is an illustrative report. Include the facts you know, and say when you are unsure.

Identify what happened

Tell your contact which of these situations apply. More than one can be true.

If money was sent, contact the bank or payment provider immediately through its trusted contact route. Do this while the technical investigation begins, not after it finishes.

If you shared a password or approved access

Reach the real service through its known app or verified website from a device you trust. Tell the account administrator what you shared or approved.

If a password was exposed, change it promptly through the legitimate service. Change it anywhere else it was reused. If you cannot sign in, use the provider's official account recovery process with your administrator's help. The FTC recommends replacing exposed passwords and enabling two-factor authentication. FTC: What to do after a scam.

A password change alone does not settle every account incident. Ask the administrator to check other access and account changes.

Microsoft's business email response guidance includes revoking active sessions, reviewing authentication methods and connected applications, and checking email forwarding. A session is an existing signed-in connection. A forwarding rule can send copies of email elsewhere. These checks address ways access or information could remain exposed. Microsoft: Responding to a compromised email account.

The exact controls depend on the service. Have the administrator apply its recovery process rather than guessing at settings. Do not send a replacement password through a mailbox that may still be accessible to someone else.

If a file or the device is involved

If a suspicious file downloaded but you have not opened it, leave it unopened and tell support where it is. Do not open it to see whether it is dangerous.

If you ran suspicious software, allowed remote control, or have reason to think the device is compromised, stop using it. Follow your incident plan to disconnect that device from Wi-Fi and wired networking, then contact trusted support from another device. Do not disconnect the whole business network by guesswork.

Avoid factory resets, wiping files, or routine restarts before support can advise you. The FTC's business breach guidance emphasizes isolating affected equipment and preserving evidence. FTC: Data breach response for businesses.

Security scans can help identify harmful software. For a managed business device, let your IT provider direct the scan and cleanup. A scan does not, by itself, tell you whether someone used a password you submitted on a website.

If payment or sensitive information is involved

Give the bank or payment provider the transaction details and ask what can be stopped, recalled, or disputed. Recovery is not guaranteed. Keep its case reference and follow the instructions it gives you.

For business email payment fraud, the FBI directs victims to contact their financial institution immediately and report the incident to its Internet Crime Complaint Center, IC3. FBI: Reporting business email compromise.

The FTC's ReportFraud service is another place to report scams. Reporting to a government service does not replace the immediate call to your payment provider.

If customer or employee information may have been exposed, bring in your trusted security support and qualified legal counsel promptly to assess the incident and any notification requirements. Use verified facts when communicating. Do not announce that nothing was affected before the investigation can support that conclusion.

Preserve a useful record

Note the approximate time, the device and account involved, what the message claimed, and the actions taken. Keep transaction references and your support contact's instructions in the business's incident record.

Do not record passwords or one-time sign-in codes in that record. Do not reopen a link just to obtain a screenshot. Ask support how to retain or submit the original message safely.

As an owner, respond to an employee report with “Thank you for telling me.” Establish the facts and address the risk. A process that depends on people hiding uncertainty is difficult to use when it matters.

A fifteen-minute exercise for your business

Prepare a small contact card containing:

1. Your primary incident contact and a backup.
2. A trusted phone number for your IT provider or device support.
3. How to reach the administrator of your business email.
4. Where to find the bank's verified fraud contact details.
5. Where the business keeps incident notes.

Then rehearse this fictional situation: an employee entered a work password on a questionable page. Have them explain whom they would call, what they would report, and which device they would use.

Discuss what changes if money was sent or a file was opened. Use a written scenario only. No real suspicious link, password, payment, or software installation is needed.

Your takeaway: Stop, report promptly, and describe what happened. Protect the affected account, device, or payment through trusted contacts, and preserve the information needed to investigate.

Test your knowledge

You have practiced recognizing suspicious requests, verifying payments, and responding when something may already have happened.

The Week 5 Knowledge Check includes eight questions about this week's articles. Choose the cumulative option for 15 questions, one from each article across the first five released weeks.

The check becomes available after Friday at 1 p.m. Eastern once all three articles are live and verified. Each answer includes an explanation and related reading.

Test your knowledge

Next week, we will cover everyday protection for devices, connections, and employee access. Follow the Small Business Learning Series.