Clicked a suspicious email link? Immediate steps to secure your device

TL;DR — If you clicked a suspicious email link, stop using that device for anything sensitive, disconnect it from Wi-Fi or unplug Ethernet, and do password changes from a different trusted device. The biggest risk is not the click by itself, but entering your password, approving a sign-in prompt, downloading a file, or giving the page permission to notifications. Reading time: ~5 min

Goal

When you finish, the affected device will be isolated, any exposed accounts will have new passwords and sign-outs applied from a safe device, and you will have enough details captured to hand off to your IT, managed security, or support contact without losing evidence.

Prerequisites

• A second trusted device you did not use to open the suspicious link (phone, tablet, or another computer)
• Access to your main email account from that trusted device
• Access to your password manager, if you use one
• Access to your important accounts from the trusted device: email, Microsoft 365 or Google Workspace, banking, payroll, shopping, and any work apps you use
• Your company or provider contact for security help, if you have one
• The suspicious email still available in your mailbox; do not delete it yet
• If the affected device is company-managed: your device management or EDR (endpoint detection and response, a security tool that monitors devices) contact or portal, if your company gave you one

Steps

Step 1: Disconnect the affected device from the internet

Use the device that clicked the link.

Windows:

• Start → Settings → Network & Internet → Wi-Fi → turn Wi-Fi Off
• If using a cable: unplug the Ethernet cable

macOS:

• Apple menu → System Settings → Wi-Fi → turn Wi-Fi Off
• If using a cable: unplug the Ethernet cable

iPhone/iPad:

• Settings → Wi-Fi → Off
• If using cellular too: Settings → Cellular → Off

Android:

• Settings → Network & internet → Internet → turn Wi-Fi Off
• Settings → Network & internet → SIMs or Mobile network → turn Mobile data Off

What you should see when this succeeds: the device shows no Wi-Fi or wired connection and pages stop loading.

⚠️ Do not shut the device down yet if you think you downloaded something, entered a password, or approved a login prompt. Keeping it on but offline preserves more evidence for your security team.

Step 2: Decide which of these happened

On paper or in a note on your trusted device, write Yes or No for each item:

• I only clicked the link and closed the page
• I typed a password into the page
• I approved a push notification or entered a one-time code
• I downloaded a file or opened an attachment after clicking
• I allowed browser notifications
• I entered payment card or banking details

What you should see when this succeeds: you have a short list of exactly what happened, which tells you which accounts to secure first.

Step 3: From a trusted device, change the password for any account you entered

Use your second trusted device, not the affected one.

Go to the real site by typing the address yourself or using a saved bookmark. Common paths:

• Microsoft account or Microsoft 365: account.microsoft.com → Security → Password security → Change my password
• Google account or Google Workspace: myaccount.google.com → Security → Password → enter a new password
• Apple ID: account.apple.com → Sign-In and Security → Password
• Your bank: type the bank's main website address yourself, then find Security or Profile → Change password

Use a new unique password for each account. If you use a password manager, generate one there.

What you should see when this succeeds: the site confirms the password was changed and old saved passwords stop working.

Step 4: Sign out other sessions for the exposed account

Still on the trusted device, go to the account's security page and sign out everywhere else.

Common paths:

• Google: myaccount.google.com → Security → Your devices → Manage all devices → select unknown or old sessions → Sign out
• Microsoft: myaccount.microsoft.com → Security → Sign-in activity → Review activity, then account.microsoft.com → Devices or security pages to sign out where available
• Many work apps: Profile picture → Account settings → Security → Sessions → Sign out all other sessions

What you should see when this succeeds: unknown devices disappear, or the account shows other sessions were signed out.

Step 5: Reset multi-factor authentication if you approved a prompt or entered a code

If you approved a sign-in prompt, entered a one-time code, or scanned a QR code on the suspicious page, treat your MFA (multi-factor authentication, an extra login step) as exposed.

Use the real account security page from the trusted device:

• Google: myaccount.google.com → Security → 2-Step Verification → turn off the old method if needed, then set it up again
• Microsoft: mysignins.microsoft.com/security-info → remove the old authenticator or phone method, then Add sign-in method
• Other services: Security → Two-factor authentication or MFA → remove and re-add your authenticator app or security key

What you should see when this succeeds: the old approval method is removed or replaced, and new sign-ins ask for the new method.

Step 6: Remove browser notifications if the suspicious site asked for them

If you clicked Allow on a pop-up asking to send notifications, remove it now on the affected device after you reconnect only long enough to change this setting, or do it later with help.

Chrome:

• Chrome → three dots → Settings → Privacy and security → Site settings → Notifications → under Allowed, remove the suspicious site

Edge:

• Edge → three dots → Settings → Cookies and site permissions → Notifications → under Allow, remove the suspicious site

Firefox:

• Firefox → menu → Settings → Privacy & Security → Permissions → Notifications → Settings… → remove the suspicious site

Safari on Mac:

• Safari → Settings → Websites → Notifications → select the suspicious site → Deny or Remove

What you should see when this succeeds: the suspicious site is no longer listed under allowed notifications.

Step 7: If you downloaded a file, report it before opening anything else

If a file was downloaded or opened, contact your IT, managed security provider, or software agency support contact immediately and say exactly this:

I clicked a suspicious email link on [device name] at about [time and time zone].
I [downloaded/opened] a file named [filename if known].
The device is now offline.
Please advise next steps for malware scanning or isolation.

If your company gave you an EDR or device portal, open it from a trusted device and create an incident with the same text.

What you should see when this succeeds: you have a ticket, email, or message sent with the device, time, and file details.

Step 8: Capture the evidence without interacting with the suspicious site again

From your trusted device or from the email app only, collect these details:

• Sender address
• Subject line
• Time received
• The link address if visible from the email without clicking again
• A screenshot of the email

Paste them into a note or send them to your security contact.

What you should see when this succeeds: you have one message or note containing the sender, subject, time, and screenshot.

Step 9: Mark the email as phishing after you have captured the details

In your mail app, use the built-in report option if present.

Common paths:

• Outlook: Home → Report → Report phishing
• Gmail web: open the message → three dots → Report phishing
• Apple Mail and other clients: move the message to Junk or Spam after reporting to your security contact

What you should see when this succeeds: the message moves to Junk/Spam or the mail app confirms the report was sent.

Verify it works

Check these end-to-end results from your trusted device:

• You can sign in to the exposed account only with the new password
• Old sessions are gone from the account's device/session list
• MFA shows the new authenticator, phone, or security key
• If browser notifications were allowed, the suspicious site no longer appears under allowed notifications
• Your security or support contact has your report with the sender, subject, time, and what actions you took
• The affected device remains offline until your security contact says to reconnect it

Common pitfalls

Changing the password on the same device that clicked the link

Mistake: You use the affected device to change passwords right away.

Symptom: If the device is compromised, the attacker may still capture the new password.

Fix: Use a different trusted device for all password and MFA changes.

Thinking "I only clicked" when you also approved a sign-in prompt

Mistake: You clicked a Microsoft, Google, or app approval prompt after the email.

Symptom: The attacker gets into the account even after you close the page.

Fix: Reset MFA on the real account security page and sign out other sessions.

Deleting the email before capturing details

Mistake: You remove the message immediately.

Symptom: Your security team has less information to block the sender or investigate.

Fix: First record sender, subject, time, screenshot, and visible link details; then report and delete or junk it.

Reconnecting the device too soon

Mistake: You put the affected device back online to "see if it's fine."

Symptom: A downloaded program or malicious page may contact its server again.

Fix: Keep the device offline until your IT or security contact tells you to reconnect it.

Forgetting browser notification permissions

Mistake: You clicked Allow for notifications on the suspicious site.

Symptom: You keep getting fake virus alerts, prize pop-ups, or scam warnings in the browser.

Fix: Remove the site from the browser's Notifications allow list.

Changing only email, but not other reused passwords

Mistake: The same password was used on other sites, but only one account was changed.

Symptom: Other accounts start showing unknown sign-ins later.

Fix: Change every account that used the same password, starting with email, banking, payroll, and work apps.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.