Clicked a bad link

In the first hour

If a colleague tells you they clicked something, thank them first, even if it happened days ago. Then work through this together.

1. Stop. Don’t type anything more into the page, and don’t reply to the message.
2. Work out what happened after the click, then take the first steps for that case in the table below.
3. Keep the message. Don’t delete it or forward it. Take a screenshot and leave the original where it is.
4. Warn the colleagues who might get the same message. Send them a screenshot with the link cut out, never the message itself.

What happened after the click	What to do first
A password typed into the page	From another device you trust, change that password now, and anywhere else it was used. Sign out of all other sessions and check that two-factor is on.
A code shared, or an app approved	Treat the account as taken over: follow Account taken over.
A file downloaded or opened, or “Enable content” clicked	Disconnect the device from the internet and don’t plug in USB sticks or drives. Change passwords from a different device, and get expert help before using it again.
Money or card details sent	Call the bank or payment provider straight away. Speed matters.
Locked files and a ransom note	Disconnect the device but leave it switched on, photograph the note and keep backup drives unplugged. Don’t rush to pay.
A warning from your phone or account provider that you may be targeted	Move sensitive conversations to a clean device, don’t reset the phone and ask a helpline to check it.
Nothing, as far as you can tell	Update the browser and the system, watch for anything odd and report it anyway.

The table follows SIIRF’s Phishing & Scams, Ransomware & Malware and Spyware & Surveillance playbooks, with Security in a Box on infected devices and the Digital First Aid Kit on clicks where nothing seemed to happen. SIIRF’s playbooks go further for whoever leads the response.

Locked files with a ransom note are ransomware: Backups covers getting your files back. A warning that you may be targeted is a threat notification, explained in Spyware and surveillance.

Checking the device

A bad link does its harm in one of two ways. It can lead to a fake login page that sends whatever you type to the attacker, or it can bring in harmful software (often called malware): a program that spies on you, steals passwords and files, or damages the device and what’s on it (SIIRF). Harmful software can arrive in a download or an attachment, and sometimes through the web page itself (Digital First Aid Kit).

So a click where nothing seemed to happen still needs a look. As the Digital First Aid Kit puts it, that “doesn’t mean that no malicious action took place in the background”, and an out-of-date browser makes it more likely (Digital First Aid Kit).

1. Update everything. Install the waiting updates for the browser, the system and the apps. Phones and laptops shows how.
2. Run a scan with the device’s own security tool, or the antivirus you already use (Security in a Box).
3. Watch it for a few days. Look out for a device that’s suddenly slow, fans running hard, programs starting that nobody opened or security software switched off (SIIRF), and for sign-ins you don’t recognise on the person’s accounts.
4. Get it checked before you reset anything if it behaves strangely, if the message was aimed at your organisation or if the person is at higher risk. A reset wipes the traces an expert would look for (SIIRF). Access Now’s Digital Security Helpline helps when a computer may be infected.
5. Reset or reinstall only as a last step, after any expert check. First copy the files you need to a clean drive, and scan them, since a document can carry the infection; don’t copy apps across (Security in a Box). Deleting data safely explains a factory reset.

Don’t open the link again to see what it does. Leave the message and any file for a helpline or an expert to look at (SIIRF; Digital First Aid Kit).

Tell people

“Sharing your suspicious message can help protect your colleagues and community who may also be affected,” as the Digital First Aid Kit says (Digital First Aid Kit). Then tell these people (SIIRF):

• whoever leads on incidents in your incident response plan, and whoever helps with your tech, straight away
• the rest of the team, with a screenshot of the message and the link removed, and without naming who clicked
• the partner, funder or colleague the message pretended to come from, through a contact you already have, so they can warn their own networks
• the bank or payment provider, if money or payment details were involved
• anyone the account then wrote to, if it was used to send more messages
• your email provider or the platform, through its own reporting tools

Write it down

As you go, or before the day is out, note (SIIRF):

• when the person clicked, when they typed a password or opened a file, and any changes to the account after that
• what the message was, who it claimed to be from, and how it got through
• what you did, when you did it and who did it

Keep the original message in the mailbox, not deleted or forwarded as an attachment, and leave the link and any file to someone qualified (SIIRF). Your incident response plan says where your notes on past incidents are kept, and SIIRF’s Incident Log has a format you can copy.

Look after the person

Farhana runs online trainings for the partner groups of a labour rights network in Dhaka. One Thursday she opened an invitation to a regional consultation and typed her email password into the page it led to. She knew at once what had happened, and told nobody until Monday, because she teaches people to spot exactly this. By then her account had sent the same invitation to dozens of partners.

Many people tell nobody at first, out of embarrassment or fear of getting into trouble. SIIRF’s guide to incident plans is plain about what that costs: “People who fear blame report late, and late reports cause the most damage” (SIIRF).

So make telling you easy, whenever it happens:

• Thank them, every time, false alarms included (SIIRF). They’ve just helped everyone else spot the same message.
• Say plainly that nobody is in trouble. These messages are made to fool careful people, trainers included.
• Ask how they are, not only what they clicked. They may be worried about what the attacker read, about the partners who got the message, or about their job. Talk those through too.
• Share the work: sit with them while they change passwords, or make the calls yourself.

Check in again a few days later. Well-being and care has more on what helps.

Close the way in

When things are calm, work out how the message got through, and close that gap (SIIRF):

• Share the lesson with the team without blaming or naming anyone, and add the message to the examples you practise with (Training your team).
• Turn on two-factor authentication, with a security key or passkey where you can: they won’t sign you in on a fake page.
• Use a password manager. It only fills in a password on the real site, so if it stays blank, stop and check.
• Keep devices and browsers updated, so a click is less likely to infect anything (Phones and laptops).
• Agree the payment rule: nobody pays new bank details or rushes a payment until they’ve called to check, on a number they already had (Phishing).
• Keep backups away from the devices you use every day, so ransomware can’t reach them.

If the message came with a call, or someone posing as a colleague or a funder, see Social engineering. If the same person or group keeps getting targeted, see Spyware and surveillance.

Teach it to your team

Try this at your next team meeting. It takes about 20 minutes.

• Prepare: have the scenario below ready, with the table from this page on paper or a screen.
• Exercise: read out this scenario: your finance officer opened an email that looked like a shared document from a donor, and typed her email password into the page that opened. She tells you an hour later. Ask the room what happened after the click and what to do first, using the table. Then agree how anyone can tell you about a click, at any hour.
• Three questions: What do you do the moment you realise you’ve clicked something? Why change the password from a different device? Who do you tell, and how soon?
• Afterwards: offer one-to-one time to anyone worried about something they clicked before, and answer “is this real?” questions in the team chat. Practise with quizzes, not fake phishing emails (Training your team). For a longer session, play SIIRF’s Chips Down: level 1 has this scenario, and level 2 a fake invitation.