Clicked a bad link checklist

In the first hour

1. Thank them, even if it happened days ago.
2. Stop. Nothing more typed into the page, and no replies.
3. Keep the message, and warn colleagues with a screenshot, the link cut out.

What happened after the click?

• A password typed in: change it from another device, everywhere it was used.
• A code shared or an app approved: treat the account as taken over.
• A file opened: disconnect the device and get expert help.
• Money sent: call the bank straight away.
• A ransom note: disconnect, leave it on, don’t rush to pay.
• Nothing, as far as you can tell: update everything and watch it for a few days.

Checking the device

• Updates installed and a scan run.
• Checked before any reset, if it acts strangely or the person is at higher risk.