Field guide / phishing response
Shared a password or approved an unexpected MFA request?
Recover through the real service and review access that may survive a password change.
Start through a trusted route
Open the official app, use a trusted bookmark or type the service address you already know. Avoid the original message and recovery adverts. On a managed work account, notify IT immediately and follow their process. If you can still sign in, use the official password controls; otherwise begin official account recovery. Do not give a helper your password or recovery codes.
A password change is not a complete investigation
Review sessions, signed-in devices, recovery methods and connected applications using the provider’s real controls. Email accounts may also need forwarding-rule review. Some access can persist after a credential change. Controls differ by provider: do not claim every session has been revoked merely because a password changed.
Explain the MFA event accurately
Report an unexpected approval or code disclosure even if you did not type a password into a suspicious page. An approval can help complete someone else’s login attempt. Reject unsolicited prompts and contact the service or your administrator. Do not approve another prompt to make repeated notifications stop.
Worked example: the shared document
Priya follows a document link, enters her work password and approves a prompt, then notices an unfamiliar domain. Her report includes both actions and their approximate time. She contacts IT and uses the real service for recovery. She does not delete logs or send her password as evidence. The team investigates account access rather than assuming this was just an unwanted email.
Prevent reuse after recovery
Change exposed passwords on accounts where they were reused, prioritising email and recovery accounts. Use unique passwords and the strongest MFA supported by your provider and organisation. CISA recommends phishing-resistant options such as security keys where available. Preventive improvements do not replace investigation of the event already reported.
Sources and scope
Source guidance informs the actions above. Explanations and worked scenarios are original. Provider controls and reporting routes vary; follow your provider and employer’s instructions.