> ## Documentation Index
> Fetch the complete documentation index at: https://docs.derekdinh.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Phishing Response: How to Identify, Contain and Report
> Identify phishing emails, contain damage after clicking a malicious link, report threats in Outlook and Gmail, and complete the post-incident checklist.
Phishing remains the most common initial attack vector in data breaches worldwide. A convincing email can bypass technical controls and land directly in an employee's inbox, relying on urgency and impersonation to override careful judgement. Knowing how to spot a phishing attempt before you click, and exactly what to do in the minutes after you do click, can be the difference between a contained incident and a full breach. This guide gives you a clear, time-sensitive playbook for both situations.
## How to Identify a Phishing Email
Examine any unexpected or suspicious email against the indicators below before you click a link, open an attachment, or reply with any information.
The display name in your email client can say anything — always inspect the actual email address. Look for:
* A domain that looks like yours but with subtle changes: `contoso-helpdesk.com`, `contos0.com`, `support-contoso.com`.
* A completely unrelated domain such as a free provider (`@gmail.com`, `@outlook.com`) for a message claiming to be from your bank or IT department.
* Unicode look-alike characters in the domain (e.g., `contosо.com` with a Cyrillic "о").
In **Outlook**, hover over the sender name or click it to expand the full SMTP address. In **Gmail**, click the down-arrow next to the sender name to see the full "mailed-by" and "signed-by" fields.
Phishing emails are engineered to short-circuit your critical thinking. Common pressure triggers include:
* *"Your account will be suspended in 24 hours."*
* *"Immediate action required."*
* *"Verify your identity to avoid service interruption."*
* *"Your package could not be delivered — click to reschedule."*
Legitimate service providers very rarely demand immediate action via email alone. When in doubt, navigate directly to the service's website by typing the URL yourself rather than clicking the email link.
Hover over any hyperlink **without clicking** to reveal the real destination URL in your browser or email client's status bar.
Red flags to look for:
* The displayed link text says `https://contoso.com/login` but the hover URL shows `https://malicious.ru/verify`.
* Legitimate-looking domain followed by a long path: `microsoft.com.account-update.net/login`.
* Shortened URLs (`bit.ly`, `tinyurl.com`) — these hide the real destination.
* HTTP (not HTTPS) for a page asking for your password.
You can expand a shortened URL safely using a service like `https://checkshorturl.com` without visiting the destination.
Be cautious of any unsolicited attachment, especially:
* **Office documents** (`.docx`, `.xlsx`) prompting you to "Enable Macros" or "Enable Editing".
* **Executable files** or archives disguised as invoices or shipping notifications (`.exe`, `.zip`, `.iso`, `.img`).
* **PDF files** with only a button or blurred-out content prompting you to click through.
If you were not expecting a file from the sender, verify via a separate communication channel (phone call or a fresh email — not a reply) before opening it.
Your bank and your IT department know your name. Greetings like *"Dear Customer"*, *"Dear User"*, or *"Hello Account Holder"* are a strong indicator of a mass-phishing campaign. Similarly, the email body may reference a service you do not use, or an account you do not have.
***
## If You Have Already Clicked a Link or Opened an Attachment
Act within the first few minutes. The faster you respond, the more damage you can limit.
Cut the machine's internet and network access to prevent any malware that may have executed from communicating with its command-and-control server, spreading laterally, or exfiltrating data.
* Unplug the **Ethernet cable** from the machine.
* Turn off **Wi-Fi** (use the physical toggle or disable in Network Settings).
* Turn off **Bluetooth**.
Do this **even if you think nothing happened**. Many malware payloads execute silently in the background. Disconnecting the machine within the first minutes can be the single most effective action you take.
Keep the machine powered on — do not shut it down — so that IT can perform forensic collection of running processes and memory if needed.
Use a **different, trusted device** (another computer, your phone on mobile data, or a known-clean machine) to change your passwords. Do not use the potentially compromised machine to do this.
**Priority order:**
1. **Corporate account / Active Directory password** — prevents the attacker from using stolen credentials to pivot.
2. **Email password** — attackers often establish email forwarding rules immediately after gaining access.
3. **Any site you were logged into at the time** of the click.
4. **Any site where you reuse the same password.**
After changing your corporate password, immediately check whether your account MFA settings or recovery options have been tampered with. Go to `https://myaccount.microsoft.com` or `https://myaccount.google.com` from the clean device.
One of the first actions an attacker takes after gaining email access is to set up an inbox forwarding rule to silently copy all your email to an external address. This persistence mechanism continues to work even after you change your password if you do not remove the rule.
**Outlook (Microsoft 365 — web):**
1. Sign in at `https://outlook.office.com` from a clean device.
2. Click **Settings (gear icon) → View all Outlook settings → Mail → Rules**.
3. Delete any rule you did not create, especially any forwarding to an external address.
4. Also check: **Settings → Mail → Forwarding** — disable automatic forwarding if it is enabled.
**Gmail:**
1. Sign in at `https://mail.google.com` from a clean device.
2. Click **Settings (gear icon) → See all settings → Filters and Blocked Addresses**.
3. Delete any filters that forward, delete, or mark as read messages you did not configure.
4. Check **Settings → Forwarding and POP/IMAP** — disable any forwarding addresses you do not recognise.
```powershell theme={null}
# Check for inbox rules on a Microsoft 365 mailbox (run by an admin)
Connect-ExchangeOnline
Get-InboxRule -Mailbox "jsmith@contoso.com" |
Select-Object Name, Enabled, ForwardTo, ForwardAsAttachmentTo, RedirectTo, DeleteMessage
```
If you find a forwarding rule you did not create, treat this as a **confirmed account compromise**. Do not just delete the rule and move on — escalate to the Security team immediately, as the attacker may have already exfiltrated sensitive email.
Changing your password does not automatically invalidate active sessions elsewhere. Revoke all existing sessions to force sign-out on any device the attacker may be controlling.
**Microsoft 365:**
1. Go to `https://myaccount.microsoft.com → Security → Sign-in activity`.
2. Review the list for unrecognised IP addresses or locations.
3. Click **Sign out everywhere** (or ask an admin to run the PowerShell below).
```powershell theme={null}
# Revoke all refresh tokens for a user (admin action)
Connect-MgGraph -Scopes "User.ReadWrite.All"
Revoke-MgUserSignInSession -UserId "jsmith@contoso.com"
```
**Google Workspace:**
1. Go to `https://myaccount.google.com → Security → Your devices`.
2. Review all listed devices and click **Sign out** on any you do not recognise.
3. Also check **Third-party apps with account access** and revoke any suspicious OAuth grants.
Preserve the email as evidence — IT and Security teams need the full message headers to trace the attack infrastructure, notify other recipients, and block the sending domain.
**Reporting in Outlook (Microsoft 365):**
*Using the built-in Report Message add-in (preferred):*
1. Select the phishing email.
2. Click **Report Message** in the Home ribbon.
3. Select **Phishing** from the dropdown.
4. Click **Report** to submit it to Microsoft and your organisation's Security team simultaneously.
*If the add-in is not available:*
1. Select the email and press `Ctrl + Alt + F` to forward it as an attachment (this preserves full headers).
2. Address the forward to your organisation's security reporting alias (e.g., `security@contoso.com` or `phishing@contoso.com`).
3. Add a brief note describing what you clicked or entered, and send.
**Reporting in Gmail:**
*Using the built-in report function:*
1. Open the phishing email.
2. Click the **three-dot menu** (More options) at the top right of the message.
3. Select **Report phishing** → **Report Phishing Message**.
*Forwarding to your IT team with full headers:*
1. Open the email → click the three-dot menu → **Show original**.
2. Click **Copy to clipboard** to copy the raw message source.
3. Paste it into a new email to your security reporting alias with the subject line: `[Phishing Report] `.
Google also accepts phishing reports at `reportphishing@apwg.org` and `phishing-report@us-cert.gov` for wider industry awareness. These are optional but valuable contributions.
Even if you did not knowingly download anything, visiting a malicious page can trigger a drive-by download exploit. Run a full malware scan on the affected machine.
1. Keep the machine **off the network** during the scan.
2. Boot into **Safe Mode** if possible (see the [Malware Removal guide](/security/malware-removal) for full instructions).
3. Run a **Windows Defender Offline Scan** or your corporate EDR tool's full scan.
4. Run **Malwarebytes** as a second-opinion scanner.
Report the scan results to IT as part of your incident documentation regardless of whether threats were found.
***
## Post-Incident Checklist
Work through this checklist after the immediate containment steps are complete. Share it with your IT contact to confirm closure.
* [ ] Machine disconnected from all networks at time of incident
* [ ] IT / Security team notified within the hour
* [ ] Passwords changed from a clean device
* [ ] MFA methods reviewed and unchanged
* [ ] Email forwarding and inbox rules checked and cleared
* [ ] Active sessions revoked on all platforms
* [ ] Phishing email reported (not deleted) via Outlook or Gmail
* [ ] Full headers and email body obtained and preserved
* [ ] Sender domain and IP address added to blocklist
* [ ] Other employees who received the same campaign identified
* [ ] Affected machine imaged or scanned by EDR tool
* [ ] Mail logs reviewed for any outbound data exfiltration
* [ ] Audit logs checked for account changes in the 24 hours following the click
* [ ] Incident ticket created with timeline, evidence, and affected users
* [ ] Clean machine returned to service or reimaged
* [ ] User re-enrolled in MFA if credentials were compromised
* [ ] User notified of incident outcome and provided refresher phishing awareness guidance
* [ ] Lessons learned documented and shared with Security team
* [ ] Incident closed in ticketing system with root cause noted
***
## Escalation
Escalate to the Security team or your incident response process immediately if:
* You entered your **username and password** on a page reached via the phishing link — treat this as a confirmed credential compromise.
* You **opened an attachment** and noticed unusual system behaviour (new processes, antivirus alerts, screen flickers).
* The phishing email appears to be a **targeted, spear-phishing** attack using your name, role, or internal project details.
* Your email account has been used to **send phishing emails to colleagues** — you will likely receive replies asking about a strange email you never wrote.
* Any **sensitive data** (customer records, financial data, credentials, or IP) may have been accessible during the compromised session.
Do not attempt to investigate the phishing link yourself by visiting it in a browser — even sandboxed browsing carries risk. Pass the URL to the Security team for analysis in a controlled environment.