You clicked the phishing link. Here is the order that limits the damage.

Almost every phishing article is written for the moment before you click. This one is written for the moment after — because that is the moment where people make the expensive mistake, and nobody covers it properly.

Here is the pattern. Someone clicks, types a password, and then does the worst possible thing: they delete the email. It feels like closing the incident. It is actually destroying the only evidence while leaving the breach wide open.

If you clicked something that looked like your bank, your courier or your tax portal, the next thirty minutes matter far more than the previous thirty. Here is the order I would work in, and why each step comes where it does.

The mistake that costs the most

Three responses do more damage than the click itself:

1. Deleting the mail. You lose the sender address, the subject line, the headers and the URL — everything you would need to report it or to prove what happened. Forward it to yourself first, or move it to a folder. Never delete before you have secured a copy.
2. Replying to ask if it's real. Reply and you confirm a live, monitored address on the other side. The reply also starts a conversation with someone whose entire job is being convincing on the second message.
3. Following instructions to "recover your account". The most common follow-up to a successful phish is a second message offering exactly that, for a fee. It is the same campaign continuing, not a rescue.

None of these are fixed by better awareness. They are fixed by having an order to follow when your hands are shaking.

Step one: change the password on the official site — not through the link

Type the address yourself, or open the app. If the account is already locked, go through the recovery route tied to the mailbox or phone you control, not through whatever page is still open in that tab.

The distinction is not pedantic. The fake page you just used may still be open in a tab, and it looks identical. Closing it before you start is the cheapest safety margin in the whole process.

If this password appears anywhere else, change it there too. Reuse is what turns one leaked login into a full compromise — an attacker's first automated move is replaying the same credential against mail providers, banks, social accounts and cloud storage.

Step two: kill the sessions the attacker opened

A password change alone does not evict an intruder who is already authenticated. Most services show active sessions with a remote sign-out option — Gmail and Outlook both do. Use it, then re-sign in on your own devices.

This step is what people skip, and it is the reason accounts get "hacked again" a week later.

Step three: check forwarding rules and the recovery address

This is the quiet back door. Attackers routinely add their own address as a hidden copy of all incoming mail, or swap the recovery email so they can reset the password later without ever needing the current one.

Look for:

• Automatic forwarding to an address you do not recognise
• A changed recovery email or recovery phone number
• New app passwords or connected third-party applications
• Filters that move a specific sender's mail straight to archive

Removing the forwarding rule is not optional cleanup — without it, changing the password accomplishes very little.

Step four: turn on two-factor, in the right order

If 2FA was off, this is when it goes on. The order matters more than people expect:

1. Primary email first. It is the recovery key for everything else. An attacker holding your mailbox can reset almost every other account you own.
2. Banking. Money moves fast and is rarely recoverable.
3. Social accounts. These are used for impersonation attacks against your contacts.
4. Cloud storage. Files, contracts, customer data.

A stolen password alone no longer gets them in — they are still missing the code on your phone. That is the whole point.

Step five: review activity, not just the password

Open banking, e-commerce and social accounts and look for actions you did not take. Small unrecognised charges are often a test before a larger one. Changed delivery addresses and new payment methods on shopping accounts are worth checking for the same reason.

If you opened an attachment rather than clicking a link, run a full scan and then review recently installed applications and browser extensions. An app installed from outside the official stores can read messages, contacts and keystrokes, and no legitimate institution asks you to sideload an app to "update a profile".

Step six: report it through the official channel

Report the message to the organisation being impersonated through their official support route so they can flag the campaign. This takes two minutes and it protects the next person, who may be less careful than you were.

If money moved, call the bank immediately rather than emailing, and file a police report. The sooner a transfer is flagged the better the chance of freezing it — this is a case where minutes genuinely matter.

The structural fix nobody sells

After the incident, the question that remains is the one phishing shares with ransomware: do you still have the files?

Account takeover and ransomware end in the same place if your only copy of critical data lives inside the account that was compromised. At least two copies, in two places, one of them not permanently connected to the machine you work on — that single habit turns a demand into an inconvenience.

The second structural fix is cheap and underrated: keep a dedicated address for signups. Mail for shops, suppliers and free trials lands in a place you never expect a colleague to write to, so anything that looks like business but arrives at the wrong inbox is instantly suspicious.

A pre-click checklist worth memorising

Two or more "no" answers together is close to certain.

Originally published at tanit365.com.