I Clicked the Link. Now What?

Quick Answer: Tell someone right away, whether that’s your IT provider, whoever handles security, or your bank. Then, depending on what happened, change any password you typed in (from a different device), disconnect from the network if you downloaded or ran something, and call your bank or card issuer if money could be involved.

Maybe it was a link in an email. Maybe it was a website that looked exactly like your bank’s. Or maybe your card number got stolen somewhere you’ll never be able to trace.

I’ve been on the receiving end of that last one twice. The first time, I was in the hospital after having my second child. The hospital food wasn’t cutting it, so my husband went to get pizza, and his debit card was declined. He texted me, I checked our account, and sure enough, it had been drained. It took days to get the money back, but thankfully, we did.

The second time was January 2026, when someone stole my work credit card number. Changing the payment method on every account that used that card was an absolute pain, but catching it quickly kept them from charging even more.

At work, it usually starts with an email. A document needs your signature. A payment failed. Your account is about to be locked.

You click. Then something feels off.

Maybe you typed in your password. Maybe you downloaded a file. Maybe you just opened the page and closed it. Whatever happened, the first step is the same: tell someone.

Start with what actually happened

A single click might turn out to be nothing. Let someone who knows what to look for make that call.

Tell your IT provider, or whoever handles security, what you opened, what you typed in, and whether you downloaded anything, installed software, or approved a login prompt.

Those details tell them where to look. “I clicked a link” and “I let someone remote into my computer” are very different problems.

If you work alone, call your IT provider directly. Keep their number somewhere you can find it without opening your email. A sticky note in your desk drawer counts.

Stop interacting with the message

Don’t keep clicking around to investigate. Don’t call a support number shown on the suspicious page, and don’t install anything it recommends.

If you ran an unexpected file, gave someone remote access, or see your computer doing things you didn’t ask it to, unplug it from the network or turn off Wi-Fi, and contact IT from a different device. Follow their instructions about what to keep.

Hold off on wiping the computer or deleting the email until your support provider has looked at it. The FTC’s breach-response guidance stresses both securing systems and preserving evidence. [1]

If you entered a password

From a different, trusted device, go to the service’s real website and change that password. Then change it anywhere else you reused it.

Let IT or the account provider know your login may have been stolen, and ask them to check active sessions, recovery settings, and any changes you didn’t make. Resetting a password doesn’t always kick out someone who’s already signed in.

For email, ask about forwarding rules and your sent folder, since scammers like to quietly forward copies of your mail to themselves. For financial accounts, check recent activity and call the provider using a number you trust.

When money or payroll is involved

Call your bank immediately if a fraudulent transfer may have gone out. If someone might have gotten into payroll or changed direct deposit information, tell your payroll provider right away.

If a card number was stolen, call the card issuer right away to cancel it, then update the new card on anything that bills it automatically. It’s tedious, and it’s a lot less tedious than disputing a month of extra charges.

The FBI recommends contacting your financial institution immediately after a business email compromise and reporting it to IC3.gov. [2] Make that first call before you have every detail sorted out.

Keep copies of the message, the payment details, and a rough timeline. Your bank and investigators may ask for them.

Make reporting easier than hiding

I always want my kids to tell me immediately when something happens. I’ve explained to them that I can’t help if they don’t tell me, and that if I find out too late, I may not be able to fix it.

The other day, one of my daughters came running up to my office crying. She’d broken a glass Christmas ornament (yes, my tree is already up, don’t judge), and she was afraid I’d be mad. This was a really large ornament, and it was filled with confetti-like sequins. It was literally a mess.

I went down, and we cleaned it up together. I told her I was glad she came to me right away, because shards of glass get everywhere and hurt when someone steps on them. Was I upset? Honestly, no. I don’t even remember the last time I used those ornaments (although I do love the others in the set). But it was a headache.

So many cyber problems are like that broken ornament. They aren’t necessarily dire if you get a handle on them right away. Give your team the same message I give my kids: if you clicked something you shouldn’t have, or something just looks off, tell someone now. The sooner you know, the more you can fix.

An employee who’s afraid of getting yelled at may sit on a problem while it grows.

Your first response should sound something like, “Thank you for telling me. Let’s get help.” Training and process fixes can wait until the immediate issue is handled.

If customer or employee information may have been exposed, bring in qualified IT and legal advisers to figure out what’s required, including any notification obligations. Don’t guess at how big the incident is.

Set this up before you need it

• Pick one person who gets reports of suspicious clicks, and make sure everyone knows who it is and that they’ll be thanked, not scolded, for speaking up.
• Write down trusted phone numbers for IT, your bank, and your payroll provider somewhere outside your email.

If something like this touches your accounting or payroll, call us at Compton & Company. We’ll handle our part while your IT team handles the technical side.

Next in our series: One email could send payroll to the wrong bank account.

Frequently Asked Questions

I clicked, but I didn’t type anything in. Do I still need to tell someone?

Yes. It takes two minutes, and it lets IT confirm nothing else happened.

Should I warn the person whose name was on the email?

Yes, once you’ve reported it at your own business. If their email account was hacked, they may not know yet, and everyone else in their contacts could be getting the same message.

Is a credit card safer than a debit card for shopping online?

For a lot of people, yes. When a debit card number is stolen, the money comes straight out of your bank account, like ours did, and you wait for it to come back. Federal law caps your liability for unauthorized credit card charges at $50. With a debit card, your protection depends on how quickly you report the problem, which is one more reason to speak up fast.

Will our business insurance cover this?

It depends on your policy. Some cover cyber incidents or funds-transfer fraud and some don’t, and many have strict reporting deadlines, so call your agent early.

Sources

[1] FTC — Data Breach Response: A Guide for Business
https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business

[2] FBI — Business Email Compromise
https://www.fbi.gov/how-we-can-help-you/common-frauds-and-scams/business-email-compromise