The First 24 Hours After a Phishing Attack

A click is not a reason to panic. It is a reason to start a controlled response.

People may click a link, reply with information, enter a password, approve a login, or open a file before they realise a message was fraudulent. The worst next step is silence. The second worst is a rush of uncoordinated “fixes” that deletes evidence, locks out the real owner, or alerts the attacker that the organisation has noticed.

Use this card for the first ten minutes, the first hour, and the rest of the first day. It is written for directors, office managers, and staff teams without a full-time security function.

First ten minutes: report, stop, preserve

1. Tell the internal owner. Contact the person named in the incident plan: a director, office manager, ICT lead, or trusted adviser. Do not leave the report inside a private chat with the person who clicked.
2. Stop further interaction. Do not click again, reply, download another file, call a number in the message, or approve an unexpected sign-in.
3. Preserve the evidence. Keep the original message, sender address, links, attachment name, screenshots if safe, and the time of each action. Do not forward a live malicious message to the whole team.
4. Write a neutral timeline. Record who received it, what happened, which account or device was involved, and whether credentials, money, files, or contacts may be affected.

NIST’s phishing guidance tells organisations to notify the appropriate people under their incident plan and to contact a financial institution immediately when a company financial account may be compromised. The order matters: get the right owner involved before the team improvises.

First hour: contain the account and device

Separate the two possible problems: stolen credentials and malicious software. A person can have entered a password without infecting the computer, or opened a file that may have executed code without knowingly submitting a password. Handle both possibilities until the response owner narrows the facts.

• Use a clean device. Change the affected account password from a device the response owner considers safe. Change any other account that reused the same password, and make each replacement unique.
• Revoke active access. Sign out sessions, remove unknown devices, revoke connected applications, and invalidate tokens where the service provides those controls.
• Protect the recovery route. Check recovery email addresses, phone numbers, MFA methods, app passwords, and newly registered devices.
• Contain a possibly infected device carefully. If the response plan or specialist instructs it, disconnect the device from the network. Do not wipe it, run random “cleanup” tools, or keep investigating from it before the evidence and business need are understood.
• Tell the owner of the data. If donor, beneficiary, student, customer, payroll, or finance information may be exposed, include the accountable data or business owner in the response.

CISA’s phishing response guidance recommends re-provisioning suspected compromised accounts, auditing access after a confirmed incident, and isolating an affected workstation when malware may have been executed. The exact button names differ by provider; the operating sequence does not.

By the end of the day: check how far it travelled

Once immediate containment is underway, look for signs that the attacker used the first access to continue. Work from a clean administrator session where possible, and record what was checked.

• Mailbox: inspect forwarding rules, inbox rules, delegates, sent mail, deleted mail, and unusual automatic replies.
• Sign-ins: review unfamiliar locations, devices, times, password resets, MFA changes, and failed or repeated login activity.
• Money: check payment instructions, supplier details, bank activity, mobile-money administration, pending transfers, and new beneficiaries.
• Files and systems: look for unexpected downloads, sharing changes, new applications, administrator changes, API keys, or access tokens.
• Contacts: identify people who may have received a fraudulent reply, invoice, link, request, or message from the compromised account.

Keep the timeline open. Add facts, not theories: “forwarding rule added at 10:14” is useful; “the attacker stole everything” may be premature. Preserve logs and the original message according to the organisation’s retention and privacy rules.

Know when to call outside the organisation

Use the incident facts to decide who must be involved. This is not a legal conclusion; it is a practical escalation guide.

• Call the bank or payment provider immediately if credentials, payment instructions, beneficiaries, bank details, mobile-money administration, or a transfer may be affected. Use a trusted number or official channel. The FBI’s Business Email Compromise guidance emphasises contacting the bank quickly when fraudulent funds may have moved.
• Contact the email, cloud, hosting, or security provider when an account, device, mailbox, website, or administrator credential may be compromised. Ask for account recovery, session revocation, logs, and preservation options.
• Contact the insurer according to the cyber, crime, professional, or business policy if one exists. Some policies require early notice or specific evidence handling.
• Obtain specialist help when ransomware, privileged access, multiple accounts, payment loss, donor or customer data, or an unclear malware event is involved.
• Check regulator and reporting requirements with the organisation’s adviser, privacy lead, contract owner, or relevant authority. Requirements depend on jurisdiction, sector, data, contracts, and what the investigation confirms.

Send staff a message that keeps reporting open

The message should name one reporting route and remain calm. Do not ask staff to post the suspicious link in a group chat. If the suspected account sent messages to others, the response owner can send a separate warning using a trusted channel.

After the first day: learn without blame

When the immediate risk is contained, hold a short review. Ask what made the message credible, which control failed or was missing, whether the response plan was findable, and what evidence was difficult to obtain. Update the plan, access controls, MFA coverage, payment verification, backups, filters, or staff practice that the facts justify.

Do not turn the review into a hunt for the person who clicked. A good response system makes reporting easier than hiding. The first 24 hours are for protecting people and evidence; the later review is for making the next report faster, clearer, and safer.