Clicked a suspicious link? Stop, identify the exposure and act on the right risk.

Use a known trusted device and the genuine account provider or work-account owner, not the suspicious page or a device suspected of malware. Explain any password/code disclosure, unexpected MFA approval, app-consent grant or remote access. For a managed work account, let the authorised owner contain access through the organisation’s incident process.

Follow the provider’s supported recovery method, use a new unique password where required and address other accounts that reused the exposed password. Do not share codes, accept more unexpected prompts or remove the only working recovery method. The email-account recovery guide covers a more detailed email response.

Have the owner review active sessions/tokens, recovery and MFA methods, app access and relevant forwarding/rules as applicable. Microsoft’s compromised-account response treats these as separate persistence checks. A new password or successful login does not establish that every session, consent or forwarding path has been removed. Preserve private evidence and verify through the actual provider.

Do not open a suspicious downloaded file to inspect it, run it again or install the page’s suggested scanner. If it was only downloaded, tell the support owner and use the approved quarantine/removal process without executing it. If software ran, remote control was allowed or compromise is suspected, stop sensitive activity and report that distinction urgently.

For an ordinary personal computer, if safe and you know how, disconnect that affected device from Wi-Fi/Ethernet to limit further access while obtaining help from another trusted device. For a managed, shared or operational system, follow the responsible owner’s containment instructions. Do not unplug unrelated equipment, disable security, restart the whole network or erase the device as a casual response.

The Australian Government’s malware-response guidance stresses using a malware-free device for sensitive account actions. Supported scanning and owner-led investigation may be needed, with preservation before any rebuild. A clean scan cannot prove no information or session was stolen; avoid connecting routine backup drives or copying unassessed software into a clean environment.

If you only viewed the page and did not knowingly enter details, approve access or open a download, record that limited exposure and close it. Check for unexpected downloads or permissions through the browser’s genuine settings, without opening suspicious files. If a permission, installation or account action was approved, return to the relevant response path.

Use the device owner’s supported update and protection process for the actual browser/operating system. Do not download a fix from the warning page, allow notifications or install a certificate/profile because it says the device is unsafe. On a managed device, report the event instead of wiping browser data or changing policy before the owner can preserve relevant evidence.

Government information-stealer guidance explains that some theft leaves little visible evidence. This does not mean every click infected a device. Keep the uncertainty proportionate: use the actual actions, supported checks and relevant account/device observations rather than either a guarantee of safety or an automatic factory reset.

Confirm each relevant response has an owner: bank/identity contact, account containment/recovery, device assessment and business reporting where applicable. Use the genuine provider and trusted device to verify required access and recovery, with known sessions, app grants and safeguards reviewed to the relevant scope.

Resume sensitive use of an affected device only through the owner’s supported assessment/recovery plan. Check the original ordinary tasks with harmless content and ensure required protection and backup are in place. Do not return to the malicious page, repeat a payment or run the downloaded file as a verification experiment.

Record actions, dates, remaining uncertainty and agreed follow-up. Watch for unexpected logins, new recovery changes, unauthorised transactions or follow-up recovery scams and report them promptly. No visible issue today proves that no data was taken; keep unresolved exposure or investigation open rather than call every account and device safe.

Tell the appropriate support owner what you clicked, when, and whether you entered credentials, approved access, ran something, allowed remote control or exposed money/identity details. Use a known private route and state uncertainties. Never send passwords, verification codes, full identity records or a live malicious attachment in an initial enquiry.

Our managed cybersecurity service page can start a discussion about the actual device, account and response needs. Agree the scope and responsibilities. Device protection, monitoring and support do not replace urgent bank contact, account-provider action or a business’s incident process.

For ongoing account compromise or malware concerns, keep the responsible owner involved until the agreed response is verified. No service can promise a click caused no disclosure, every stolen session is already gone or lost money will be recovered. The useful next action is tied to the actual exposure and evidence.