Emergency guide · by AlphaIT
I Clicked a Phishing Link. What Do I Do Now?
Don’t panic, and don’t wait. Tell us what happened and get the exact steps for the next 15 minutes, the next hour and today, in the right order.
Why the order matters
The First Hour Decides How Bad It Gets
Attackers move fast once they have a password: they sign in, hide their tracks and use your account to reach the next victim. Each step below closes a door.
Disconnect, don’t switch off
If malware or remote-access software got in, cutting the internet stops it spreading or calling home. Leaving the PC on keeps evidence.
New password from a clean device
Changing the password on an infected computer can hand the new one straight to the attacker.
Sign out every session
A stolen sign-in session keeps working after a password change. In Microsoft 365, an admin revokes sessions in Entra.
Check inbox rules
Attackers add rules that forward or hide email so they can read replies about invoices and payments unnoticed.
Call the bank first
For money sent, the first call matters more than the report. Banks can sometimes stop or recall a payment if you’re quick.
Tell people
Your IT provider, your manager, and anyone who may have received a scam email from your account.
After the emergency
Then Make Sure It Can’t Happen the Same Way Again
Most of these incidents start with a password on a fake page. Phishing-resistant sign-in methods, such as passkeys and Windows Hello, simply won’t work on a fake site.
Pair that with short, regular staff training, so the next suspicious email gets reported instead of clicked.
Frequently asked questions
Phishing Emergency FAQs
The questions people ask in the first hour.
I only clicked the link. Am I hacked?
Probably not. If you only opened the page and didn’t type a password, download a file or approve anything, the risk is low. Close the page, run an antivirus scan, and let your IT provider know so they can block the site for everyone else.
I typed my password. Is changing it enough?
Not always. If you also entered a code or approved a prompt, the attacker may already have a signed-in session that survives a password change. Every session needs to be signed out, and the account checked for new MFA methods and inbox rules.
Should I turn my computer off?
No. Disconnect it from the internet instead, by turning off Wi-Fi or unplugging the cable, and leave it on. That stops the damage and keeps the evidence your IT provider needs.
I sent money to a scammer. Can I get it back?
Sometimes, if you act fast. Call your bank or card issuer immediately on the number on your card, then report it to the Canadian Anti-Fraud Centre and local police. Be wary of anyone who later offers to “recover” your money for a fee: that’s often the same scammers.
Where do I report a phishing scam in Canada?
To the Canadian Anti-Fraud Centre online, or at 1-888-495-8501. Forward scam texts to 7726. Use the Report phishing button in Outlook or Gmail.
Will I get in trouble at work?
You shouldn’t. These scams fool careful people every day. What matters is reporting it quickly. Waiting is what turns a mistake into an incident.
Can AlphaIT help right now?
Yes. We help Edmonton businesses lock down hacked accounts, check infected computers and work out what was accessed. Call 780-318-0149; we’re open every day from 11 am to 7 pm.
Hacked account or infected computer?
Call Us and We’ll Help You Contain It
Remote and on-site help for Edmonton businesses: locking down Microsoft 365 and Google accounts, checking computers and finding out what was accessed.
780-318-0149
Edmonton, AB · serving the Edmonton region