Field guide / phishing response
Clicked a suspicious link? Start with what happened next.
Separate opening a page, submitting information and running a download.
Stop interacting; identify the event
Close the suspicious page. Do not revisit it, reply to the sender or use a number supplied by the message. Write down whether you entered information, whether a file downloaded and whether you opened or installed it. These are different events. If this happened at work, report promptly through your existing process; you do not need to prove an attack before asking for help.
Choose the response from the facts
If you submitted a password, use the real service’s recovery controls. If you supplied banking details or sent money, contact the provider immediately through its official app or a known number. If you opened suspicious software, get device help and use trusted security software. A click alone does not establish that a device is infected; absence of obvious symptoms does not prove it is clean.
Worked example: the delivery notice
Sam opens a delivery link on a work laptop, sees a login form, closes it without typing and notices no download. The useful report says exactly that. It does not say the laptop is infected or everything is safe. If Sam later remembers approving an installation, the report must be updated: the new fact changes the response branch. A short accurate note is more useful than a confident guess.
Preserve a useful account of events
Record approximate time, affected service and device, actions taken and what remains uncertain. Follow the responder’s instructions for handling the original message. Do not forward attachments widely or send credentials as evidence. Screenshots can contain private information too. Do not delay urgent account or financial recovery to complete a perfect report.
Where this workflow stops
This page cannot inspect your browser, recover a session or perform forensics. Persistent alerts, unfamiliar account settings or unexpected software need investigation through your provider or IT team. Do not install a cleaner promoted by the suspicious page. Organisational response procedures take priority for work systems.
A concise incident note, ready to fill in
Use the blank note to separate observed facts from uncertainty. The filled example shows how to describe opening a delivery link without claiming a device is safe or infected.
Download the blank incident note (.txt) · Read the synthetic filled example (.txt)
Sources and scope
Source guidance informs the actions above. Explanations and worked scenarios are original. Provider controls and reporting routes vary; follow your provider and employer’s instructions.