Skip to main content
Phishing remains the most common initial attack vector in data breaches worldwide. A convincing email can bypass technical controls and land directly in an employee’s inbox, relying on urgency and impersonation to override careful judgement. Knowing how to spot a phishing attempt before you click, and exactly what to do in the minutes after you do click, can be the difference between a contained incident and a full breach. This guide gives you a clear, time-sensitive playbook for both situations.

​
How to Identify a Phishing Email

Examine any unexpected or suspicious email against the indicators below before you click a link, open an attachment, or reply with any information.
The display name in your email client can say anything — always inspect the actual email address. Look for:
  • A domain that looks like yours but with subtle changes: contoso-helpdesk.com, contos0.com, support-contoso.com.
  • A completely unrelated domain such as a free provider (@gmail.com, @outlook.com) for a message claiming to be from your bank or IT department.
  • Unicode look-alike characters in the domain (e.g., contosо.com with a Cyrillic “о”).
In Outlook, hover over the sender name or click it to expand the full SMTP address. In Gmail, click the down-arrow next to the sender name to see the full “mailed-by” and “signed-by” fields.
Phishing emails are engineered to short-circuit your critical thinking. Common pressure triggers include:
  • “Your account will be suspended in 24 hours.”
  • “Immediate action required.”
  • “Verify your identity to avoid service interruption.”
  • “Your package could not be delivered — click to reschedule.”
Legitimate service providers very rarely demand immediate action via email alone. When in doubt, navigate directly to the service’s website by typing the URL yourself rather than clicking the email link.
Hover over any hyperlink without clicking to reveal the real destination URL in your browser or email client’s status bar.Red flags to look for:
  • The displayed link text says https://contoso.com/login but the hover URL shows https://malicious.ru/verify.
  • Legitimate-looking domain followed by a long path: microsoft.com.account-update.net/login.
  • Shortened URLs (bit.ly, tinyurl.com) — these hide the real destination.
  • HTTP (not HTTPS) for a page asking for your password.
You can expand a shortened URL safely using a service like https://checkshorturl.com without visiting the destination.
Be cautious of any unsolicited attachment, especially:
  • Office documents (.docx, .xlsx) prompting you to “Enable Macros” or “Enable Editing”.
  • Executable files or archives disguised as invoices or shipping notifications (.exe, .zip, .iso, .img).
  • PDF files with only a button or blurred-out content prompting you to click through.
If you were not expecting a file from the sender, verify via a separate communication channel (phone call or a fresh email — not a reply) before opening it.
Your bank and your IT department know your name. Greetings like “Dear Customer”, “Dear User”, or “Hello Account Holder” are a strong indicator of a mass-phishing campaign. Similarly, the email body may reference a service you do not use, or an account you do not have.
Act within the first few minutes. The faster you respond, the more damage you can limit.
1

Disconnect From the Network Immediately

Cut the machine’s internet and network access to prevent any malware that may have executed from communicating with its command-and-control server, spreading laterally, or exfiltrating data.
  • Unplug the Ethernet cable from the machine.
  • Turn off Wi-Fi (use the physical toggle or disable in Network Settings).
  • Turn off Bluetooth.
Do this even if you think nothing happened. Many malware payloads execute silently in the background. Disconnecting the machine within the first minutes can be the single most effective action you take.
Keep the machine powered on — do not shut it down — so that IT can perform forensic collection of running processes and memory if needed.
2

Change Your Passwords Immediately From a Clean Device

Use a different, trusted device (another computer, your phone on mobile data, or a known-clean machine) to change your passwords. Do not use the potentially compromised machine to do this.Priority order:
  1. Corporate account / Active Directory password — prevents the attacker from using stolen credentials to pivot.
  2. Email password — attackers often establish email forwarding rules immediately after gaining access.
  3. Any site you were logged into at the time of the click.
  4. Any site where you reuse the same password.
After changing your corporate password, immediately check whether your account MFA settings or recovery options have been tampered with. Go to https://myaccount.microsoft.com or https://myaccount.google.com from the clean device.
3

Check for Malicious Email Forwarding Rules

One of the first actions an attacker takes after gaining email access is to set up an inbox forwarding rule to silently copy all your email to an external address. This persistence mechanism continues to work even after you change your password if you do not remove the rule.Outlook (Microsoft 365 — web):
  1. Sign in at https://outlook.office.com from a clean device.
  2. Click Settings (gear icon) → View all Outlook settings → Mail → Rules.
  3. Delete any rule you did not create, especially any forwarding to an external address.
  4. Also check: Settings → Mail → Forwarding — disable automatic forwarding if it is enabled.
Gmail:
  1. Sign in at https://mail.google.com from a clean device.
  2. Click Settings (gear icon) → See all settings → Filters and Blocked Addresses.
  3. Delete any filters that forward, delete, or mark as read messages you did not configure.
  4. Check Settings → Forwarding and POP/IMAP — disable any forwarding addresses you do not recognise.
If you find a forwarding rule you did not create, treat this as a confirmed account compromise. Do not just delete the rule and move on — escalate to the Security team immediately, as the attacker may have already exfiltrated sensitive email.
4

Review Active Sessions and Revoke Access Tokens

Changing your password does not automatically invalidate active sessions elsewhere. Revoke all existing sessions to force sign-out on any device the attacker may be controlling.Microsoft 365:
  1. Go to https://myaccount.microsoft.com → Security → Sign-in activity.
  2. Review the list for unrecognised IP addresses or locations.
  3. Click Sign out everywhere (or ask an admin to run the PowerShell below).
Google Workspace:
  1. Go to https://myaccount.google.com → Security → Your devices.
  2. Review all listed devices and click Sign out on any you do not recognise.
  3. Also check Third-party apps with account access and revoke any suspicious OAuth grants.
5

Report the Phishing Email to IT Without Deleting It

Preserve the email as evidence — IT and Security teams need the full message headers to trace the attack infrastructure, notify other recipients, and block the sending domain.Reporting in Outlook (Microsoft 365):Using the built-in Report Message add-in (preferred):
  1. Select the phishing email.
  2. Click Report Message in the Home ribbon.
  3. Select Phishing from the dropdown.
  4. Click Report to submit it to Microsoft and your organisation’s Security team simultaneously.
If the add-in is not available:
  1. Select the email and press Ctrl + Alt + F to forward it as an attachment (this preserves full headers).
  2. Address the forward to your organisation’s security reporting alias (e.g., [email protected] or [email protected]).
  3. Add a brief note describing what you clicked or entered, and send.
Reporting in Gmail:Using the built-in report function:
  1. Open the phishing email.
  2. Click the three-dot menu (More options) at the top right of the message.
  3. Select Report phishing → Report Phishing Message.
Forwarding to your IT team with full headers:
  1. Open the email → click the three-dot menu → Show original.
  2. Click Copy to clipboard to copy the raw message source.
  3. Paste it into a new email to your security reporting alias with the subject line: [Phishing Report] <brief description>.
Google also accepts phishing reports at [email protected] and [email protected] for wider industry awareness. These are optional but valuable contributions.
6

Scan the Machine for Malware

Even if you did not knowingly download anything, visiting a malicious page can trigger a drive-by download exploit. Run a full malware scan on the affected machine.
  1. Keep the machine off the network during the scan.
  2. Boot into Safe Mode if possible (see the Malware Removal guide for full instructions).
  3. Run a Windows Defender Offline Scan or your corporate EDR tool’s full scan.
  4. Run Malwarebytes as a second-opinion scanner.
Report the scan results to IT as part of your incident documentation regardless of whether threats were found.

​
Post-Incident Checklist

Work through this checklist after the immediate containment steps are complete. Share it with your IT contact to confirm closure.
  • Machine disconnected from all networks at time of incident
  • IT / Security team notified within the hour
  • Passwords changed from a clean device
  • MFA methods reviewed and unchanged
  • Email forwarding and inbox rules checked and cleared
  • Active sessions revoked on all platforms
  • Phishing email reported (not deleted) via Outlook or Gmail
  • Full headers and email body obtained and preserved
  • Sender domain and IP address added to blocklist
  • Other employees who received the same campaign identified
  • Affected machine imaged or scanned by EDR tool
  • Mail logs reviewed for any outbound data exfiltration
  • Audit logs checked for account changes in the 24 hours following the click
  • Incident ticket created with timeline, evidence, and affected users
  • Clean machine returned to service or reimaged
  • User re-enrolled in MFA if credentials were compromised
  • User notified of incident outcome and provided refresher phishing awareness guidance
  • Lessons learned documented and shared with Security team
  • Incident closed in ticketing system with root cause noted

​
Escalation

Escalate to the Security team or your incident response process immediately if:
  • You entered your username and password on a page reached via the phishing link — treat this as a confirmed credential compromise.
  • You opened an attachment and noticed unusual system behaviour (new processes, antivirus alerts, screen flickers).
  • The phishing email appears to be a targeted, spear-phishing attack using your name, role, or internal project details.
  • Your email account has been used to send phishing emails to colleagues — you will likely receive replies asking about a strange email you never wrote.
  • Any sensitive data (customer records, financial data, credentials, or IP) may have been accessible during the compromised session.
Do not attempt to investigate the phishing link yourself by visiting it in a browser — even sandboxed browsing carries risk. Pass the URL to the Security team for analysis in a controlled environment.