Phishing Response Checklist: The First Hour After Someone Clicks
Someone clicked. The question that decides whether this is a story or a breach is not "how did they get in" — it's "what did they take, and can they still take more". The checklist has four parts: contain in ten minutes, scope what was accessed, revoke sessions before resetting passwords, and say the right amount to the team. No security department required — this fits on one screen and finishes inside an hour.
1. The first 10 minutes: contain, don't interrogate
Do these in order. Not all at once, and not after a meeting:
- Revoke the affected account's active sessions (Google: Security → Your devices; Microsoft 365: sign-out everywhere; SSO admin console for the rest). Stolen sessions die here.
- Check and remove attacker mailbox rules — especially forwarding rules and the "delete the originals" rule that hides replies from the victim. This is the #1 persistence trick and it survives a password reset.
- Revoke OAuth app grants the user doesn't recognise (Gmail: Security → Third-party access; M365: Enterprise applications consent). A malicious "PDF viewer" app outlives every password you reset.
- Disable, don't delete, the account if you're unsure how deep it goes. Deletion destroys the evidence you're about to need.
- Screenshot as you go. Rules, grants, sent items, login alerts — before you change anything. Postmortems starve without evidence.
One rule for the whole hour: nobody gets blamed for clicking. The moment people hide clicks, you lose the hours that matter.
2. Work out what the attacker actually got
"Clicked a link" is not the incident. The incident is whatever the click enabled:
| Check | Where | You're looking for |
|---|
| Sent items & drafts | Mailbox | Replies sent as the victim (usually to finance, or "quick favour" asks) |
| Mailbox rules | Mail settings | Auto-forward, mark-as-read/delete rules |
| OAuth grants | Account security page | Apps with mail/files scope granted days ago |
| MFA changes | Security activity log | New device, new phone number, disabled second factor |
| Password reuse | Ask + password manager | The same password on payroll, VPN, or the bank |
The sent-items check matters most for small companies: the classic second stage is emailing your own finance person from the compromised mailbox, asking for an urgent payment. Twenty minutes after containment, warn the people who'd receive that message.
3. Revoke first, reset second (order matters)
Resetting a password kills future logins with the old password — and nothing else. Stolen session cookies, OAuth grants, and app passwords all survive a reset. The order that actually ends an intrusion:
- Revoke sessions (step 1 — already done).
- Remove malicious rules and grants (step 1 — already done).
- Then reset the password, from a different device than the one that was compromised.
- Re-enrol MFA and check the second factor wasn't swapped.
- Sweep for reuse: if that password was used anywhere else, reset those too — this is where one click becomes five accounts.
If the machine itself was involved (credential prompt on the laptop, executable opened, don't know), add one more line: malware scan + watch the account for 72 hours, and treat the endpoint as untrusted until proven otherwise. A password reset does not clean a laptop.
4. Tell people the right amount
- To the clicker, immediately: "Thank you for telling us — exactly the right call. We're handling it; don't touch the laptop for now." Praise out loud; it's the cheapest control you own.
- To likely second-stage targets (finance, admins), within the hour: "A mailbox was accessed. If you get an urgent payment or credential request — even from a real colleague — verify by phone on a number you already have."
- To the whole team, once it's contained (same day): one message: what happened, what was done, and "if you clicked something odd, tell us in the next five minutes — today clicking fast costs nothing."
- To customers: only if outbound phishing used your identity at scale — then use the status page template and say what you know, plainly.
5. The one-hour timeline
| Time | Done |
|---|
| 0–10 min | Sessions revoked, malicious rules/grants removed, account disabled if depth unknown. Screenshots taken. |
| 10–30 min | Scope check (sent items, grants, MFA changes), finance warned about payment-fraud second stage. |
| 30–45 min | Password reset + MFA re-enrol + reuse sweep on other accounts. |
| 45–60 min | Endpoint scan if needed, one "what happened / what we did" message, report-the-click culture restated. |
| Day+1 | 15-minute review: what did the phish impersonate, what filter/announcement closes that door, log it as a mini-postmortem. |
6. The mistakes that turn a click into a breach
- Password reset as the whole response. Sessions and grants survive resets — attackers log back in with the "session" they never needed a password for.
- Missing the mailbox rules. The forward-and-delete rule silently keeps the mailbox compromised for weeks. It's a two-minute check.
- Punishing the click. One shamed employee = every future click hidden for days. Hidden clicks are how one hour becomes one month.
- Forgetting reuse. The work password lives in a personal account somewhere; the reset that skips it resets nothing that matters.
- Skipping the Day+1 review. The next phish will copy this one. Close the specific door it opened.
Takeaways
- Contain in ten minutes: revoke sessions, strip rules and grants — then reset passwords.
- Scope what was taken, not just what was clicked; warn finance about payment-fraud second-stage asks.
- Praise the report, never the blame — reporting speed is your real MFA.
---
When the checks pile up, automate the boring ones. The Automation Starter Pack ($19) includes pick-first workflows for exactly this layer — access reviews, rotation sweeps, and the weekly security review — pre-assembled so they run by themselves. The Ops Starter Kit ($14) covers the day an incident actually lands. Launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout.