Clicked a suspicious link at work? What to do next.

First, stop and report

1. 1.Close the page or message. Do not enter anything else, and do not reply.
2. 2.Tell your organisation's IT or security contact straight away, by the route you normally use: the helpdesk, your IT provider or the named person. The NCSC's advice for anyone on a work device is to contact the IT department and tell them what happened.
3. 3.Keep the message. IT may need it.
4. 4.Carry on with other work only when IT says it is fine to.

Report it even if you are not sure anything happened. Nobody should be blamed for clicking a convincing message, and an early report gives IT the best chance of limiting any harm.

What happened after you clicked?

The right response depends on which of these applies. Tell IT which one, as precisely as you can.

You only opened the link

If you did not enter information, download a file or install anything, the NCSC says further action is unlikely to be needed. Opening a link does not, on its own, mean your device has been compromised. Report it anyway, so that IT can check and warn others.

You entered a password

Tell IT immediately. The password needs changing through the real service, never through a link in the message, and on any other account where you used the same one. A new password may not be enough by itself: your administrator should also check for sign-ins you did not make and end any active sessions.

You approved a sign-in request you were not expecting

Tell IT immediately, and say that you approved it. If the request was not yours, someone else may have been signing in as you, so it needs the same review as a password that has been given away.

You downloaded or opened a file

Tell IT and leave the device as it is until they advise. The NCSC's general advice is to run a full antivirus scan; on a work device, let IT decide how. Do not try to reset or clean the device yourself, because that can remove information IT needs.

You shared payment details or made a payment

Contact your bank immediately, using the number on its official website or on your card. Then tell IT and whoever is responsible for finance.

What to tell IT

• When it happened.
• Which message it was: the sender, the subject and when it arrived.
• The address of the website, if you can see it without visiting it again.
• What you entered: a username, a password, a code, payment details.
• Whether you approved a sign-in request.
• Any file you downloaded or opened.
• Which device you were using, and whether it belongs to the organisation.

Reporting it outside your organisation

Outside reporting helps protect other people. It does not replace telling your own IT contact, who is the one able to act on your account and device.

• Forward a suspicious email to the NCSC at report@phishing.gov.uk. Ask IT first whether they would rather do this themselves.
• Forward a suspicious text message to 7726.
• If money has been lost, report it to Report Fraud online or on 0300 123 2040 in England, Wales and Northern Ireland, or to Police Scotland on 101 in Scotland.
• UK organisations can report a cyber incident at gov.uk/report-cyber.

When to involve your IT provider

Always, and at once, if a password was entered, a sign-in was approved, a file was opened or money was involved. If you have no IT contact and think an account has been taken over, the NCSC publishes a step-by-step guide to recovering a hacked account.

Our enquiry form is not an emergency channel. If something is happening now, contact your bank or your IT support first.