Phishing Incident Response Checklist
A phishing response checklist for small IT teams: triage the reported email, purge it from inboxes, reset compromised accounts and check for follow-on attacks.
- Typical schedule per incident
- The checklist 5 sections, 20 items
- Variables
{{reporter}}
Start this checklist when someone reports a suspicious email, or when a user admits they clicked a link or entered their password. Speed matters: a stolen password can be used within minutes, and attackers often send the same email to many people in one company. The checklist works for Microsoft 365, Google Workspace and most other mail platforms.
Who owns it
The IT or security person on duty owns the run. They triage, contain and decide whether it becomes a wider incident. The person who reported the email should be thanked and kept informed. Adapt this to your jurisdiction; it is a practical checklist, not legal advice.
Common pitfalls
- Blaming the person who clicked. People who fear blame stop reporting. A fast report after a click is the best outcome you can hope for.
- Resetting the password and stopping there. Attackers create mailbox forwarding rules, register their own MFA device or grant OAuth app access. A password reset alone does not remove those.
- Only cleaning one inbox. Search for the same sender, subject or link across all mailboxes.
- Not checking for business email compromise. Look for payment change requests sent from the compromised account to customers or suppliers.
- Opening links on your own laptop. Analyse URLs and attachments in a sandbox or with an online scanner.
The checklist: Phishing report from {{reporter}}
Triage
-
Get the original email from
{{reporter}}as an attachment, with full headers -
Check the sender, reply-to address, links and attachments without opening them on a normal workstation
Use a URL scanner or sandbox for links and attachments.
-
Decide whether it is phishing, spam or a legitimate email, and tell
{{reporter}} -
Ask
{{reporter}}whether they clicked, opened an attachment or entered credentials
Contain
-
Search all mailboxes for the same sender, subject or URL and list the recipients
-
Remove the email from all mailboxes, or move it to quarantine
-
Block the sender domain, URLs and attachment hashes in the mail filter and web filter
-
Ask other recipients whether they interacted with it
If credentials were entered or a link was clicked
-
Reset the password and sign out all sessions for each affected account
-
Review and remove unknown MFA methods registered on the account
-
Check for new mailbox rules, forwarding addresses and delegated access, and remove unknown ones
-
Review OAuth app grants on the account and revoke unknown apps
-
Review sign-in logs for unusual locations or devices since the email arrived
-
Scan the device for malware if an attachment was opened optional
Check for wider impact
-
Check sent items of affected accounts for phishing or payment-change emails to others
-
Warn finance and key customers or suppliers if the account sent fraudulent messages optional
-
Decide whether personal data was exposed and start the data breach procedure if so
Close
-
Record the timeline, affected accounts and actions in the incident log
-
Thank
{{reporter}}and share a short warning with staff if the campaign was targeted -
Create tickets for improvements, such as stronger MFA or better mail filter rules
Checklist as Markdown
Frequently asked questions
What should I do immediately after clicking a phishing link?
Tell your IT or security contact straight away, even if nothing seemed to happen. If you entered a password, change it from a trusted device and sign out other sessions. The IT team should then check the account for new forwarding rules, MFA devices and app grants.
How do I remove a phishing email from all mailboxes?
Most mail platforms have an admin search and purge feature, for example content search in Microsoft 365 or the investigation tool in Google Workspace. Search by sender, subject or URL, review the results, then delete or quarantine the matches. Record how many mailboxes were affected.
Is a phishing incident a data breach?
Not always. It becomes a personal data breach if the attacker accessed, changed or exported personal data, for example by reading a compromised mailbox. Check the account activity and follow your data breach procedure if personal data may have been exposed.
Updated