01
Clicked a suspicious link? Start with what happened next.
Separate opening a page, submitting information and running a download.
Practical cybersecurity for small teams
Something feels wrong.
Know your next move.
Separate what happened from what you suspect. Build a focused recovery checklist and a clear handoff to the people who can help.
Start with what happened →Your response plan
If money or banking details are involved, contact your bank immediately through its official app or a known number. Do not wait to finish this planner.
A concise incident note, ready to fill in
Use the blank note to separate observed facts from uncertainty. The filled example shows how to describe opening a delivery link without claiming a device is safe or infected.
Download the blank incident note (.txt) · Read the synthetic filled example (.txt)
Understand the decision
Useful guidance, before and after the click.
02
Shared a password or approved an unexpected MFA request?
Recover through the real service and review access that may survive a password change.
03
A supplier changed bank details. Verify outside the message.
Independent verification is a control; familiar branding is not.
04
Why polished writing and authentication cannot prove an email is safe
AI changes presentation. It does not replace independent verification.
A useful small-team handoff
Tell the responder the approximate time, affected account or device, whether you typed a credential, approved a prompt, opened a file or sent money, and what you did next. Keep uncertainty visible. Do not include passwords, recovery codes or banking details. Use your established reporting process for evidence.
Why this is a planner, not an AI safety verdict
AI-generated phishing can be fluent, and an automated verdict can be confidently wrong. This planner uses explicit branches with source-linked guidance. It cannot observe your account, inspect your device or prove recovery succeeded.