[{"data":1,"prerenderedAt":174},["ShallowReactive",2],{"publication:en:P116":3},{"meta":4,"copy":17,"relatedArticles":133,"terms":166,"term":167,"resourceParent":168,"glossaryParent":171},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P116","\u002Fblog\u002Fphishing-link-clicked","article","clicked a phishing link what to do","Clicked a phishing link? Choose the response by what happened","Clicked a phishing link? Business response steps","Separate a link visit from password entry, MFA approval, app consent and software installation. Report clearly and choose account, device or payment response.",[13,14],"\u002Femergency","\u002Fservices\u002Faccess-2fa-audit","2026-06-30","2026-10-30",{"intro":18,"sections":19,"checklist":92,"faq":98,"links":108,"sources":125,"cta":128},"If you clicked a phishing link, stop interacting and report what happened next: a visit only, information entry, sign-in approval, application consent, download, installation or payment. Clicking alone does not establish that an account or device was compromised. The response must follow the actual exposure, with prompt bank contact if financial details or money were involved and an administrator involved for workplace accounts or devices.",[20,25,65,74,82,87],{"title":21,"paragraphs":22},"Stop the sequence and tell the responsible owner",[23,24],"Close the suspicious interaction without returning to it for more evidence. Tell the workplace administrator or named incident contact promptly, even if you are unsure what happened. Describe the time, account and device, whether a page opened and which later steps you remember. State uncertainty directly. A factual report lets the owner choose the next action without relying on a blanket diagnosis of a hacked computer.","Keep the original message available through the approved reporting route. Do not circulate it widely, submit confidential URLs to a public checker or delete everything to hide an accidental interaction. A private invitation or login link can itself carry sensitive information. If the usual owner is unavailable, use the defined backup contact; do not ask the sender of the questionable message for recovery instructions.",{"title":26,"paragraphs":27,"sources":30,"table":34},"Choose the branch by exposure, not by fear",[28,29],"The UK NCSC distinguishes a suspicious visit without information entry or installation from situations involving passwords, banking details or software. That distinction avoids both unnecessary panic and an incomplete response. For a workplace event, notify the responsible owner even when the initial facts suggest limited exposure. Monitoring or additional review should reflect what is known and the organization's environment.","Our exposure record is a triage aid, not a diagnostic test or a guarantee of safety. More than one row may apply. If a person entered a password and installed remote-access software, account and device actions need coordination. Record the evidence available for each branch so the incident owner can decide what needs immediate containment and what needs verification afterward.",[31],{"label":32,"url":33},"UK NCSC: actions after a suspicious link or disclosure","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fsection\u002Frespond-recover\u002Fphishing",{"caption":35,"headers":36,"rows":40},"Post-click exposure and response record",[37,38,39],"What happened","Immediate owner or route","Follow-up question",[41,45,49,53,57,61],[42,43,44],"Visit only, no later action known","Workplace owner; stop interacting.","Was anything downloaded, approved or disclosed?",[46,47,48],"Password entered","Account owner through the genuine service.","Which accounts reused it and what access remains?",[50,51,52],"MFA or sign-in approved","Identity administrator.","Which session or authentication change was authorized?",[54,55,56],"Application access granted","Application and account administrator.","Which consent and permissions need review?",[58,59,60],"Software ran or remote control started","Workplace device-response owner.","What containment and evidence handling are appropriate?",[62,63,64],"Bank details or money involved","Genuine bank\u002Fpayment-provider channel.","Can the transaction or instrument be protected?",{"title":66,"paragraphs":67,"sources":70},"Separate passwords, sessions and application consent",[68,69],"If a password was disclosed, use the genuine service from a device considered trustworthy to change it and address reused credentials. Do not follow a recovery link supplied by the suspicious conversation. If the device may itself be affected, ask the administrator for a clean route rather than type the replacement password into the same questionable environment.","Account recovery may also require session and authorization review. Microsoft's Microsoft 365 response guidance treats session revocation, authentication methods, application consent and forwarding as separate checks. An approved app can have an access path that is not resolved simply by changing the user's password. Follow the current provider process with an authorized administrator and document which actions were completed and which remain uncertain.",[71],{"label":72,"url":73},"Microsoft: responding to a compromised Microsoft 365 email account","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Fresponding-to-a-compromised-email-account",{"title":75,"paragraphs":76,"example":79},"Treat downloads and device concerns as their own problem",[77,78],"A file arriving on a device, a file being opened and software being installed are different events. Tell the device owner what you observed rather than launching the file again to identify it. If a remote-control session or active suspicious behavior is present, contact the responsible IT route immediately and follow its containment instructions. Avoid self-directed wiping or broad configuration changes that could disrupt recovery or remove useful evidence.","Use supported security software and the organization's response process. A clean scan does not prove that every account authorization or payment instruction was safe. Likewise, a successful password reset does not resolve every device concern. Keep the case open until the appropriate owners have checked the relevant branches, recorded their evidence and explained the limits of what could be established.",{"title":80,"text":81},"Illustrative example: no password entered, but access approved","A fictional employee follows a document invitation and approves an application permission. They report that no password was typed, which is true but incomplete. The administrator reviews the application grant and its scope through the genuine account console. This example shows why consent must be recorded separately; it is not a report of a real account compromise or a claim that every grant is malicious.",{"title":83,"paragraphs":84},"Prioritize financial exposure and restricted information",[85,86],"If card or banking details were entered, or a payment was released, contact the genuine bank or payment provider promptly. Use an established app, stored contact or independently verified channel. Do not wait for a technical enquiry to be scheduled before asking the provider about the transaction. Preserve the known payment reference and status through an appropriate secure route.","If business or customer information was disclosed, tell the incident owner what categories were involved without spreading another copy. The organization may need legal, contractual or insurer input according to the circumstances and countries. US, UK and Singapore source pages describe their own reporting routes; they do not establish a universal notification deadline or authority for a worldwide business. Recovery and complete impact assessment cannot be guaranteed.",{"title":88,"paragraphs":89},"Close with verified actions and an owned follow-up",[90,91],"A useful closeout says what happened, which accounts or devices were reviewed, which access was removed, what was restored and what remains unknown. Confirm that business access still works through the intended route and that the reporting contact knows the outcome. If evidence is missing, keep that limitation in the record rather than translate it into a claim that no incident occurred.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide. We bring practical Israeli technical knowledge to scoped website, business-email and account-control work. Describe the affected system and known actions in an initial enquiry without sharing passwords, live codes or confidential records. We do not claim a guaranteed emergency response time, payment recovery, full forensic coverage or a continuously staffed response service.",[93,94,95,96,97],"Stop interacting and report the exact sequence promptly.","Separate visit, disclosure, approval, download, installation and payment.","Use a trustworthy route for account recovery.","Review sessions and application grants alongside password exposure.","Let the appropriate owner verify closure and record uncertainty.",[99,102,105],{"question":100,"answer":101},"I clicked but entered nothing. Must I reset every account?","A visit alone does not automatically establish account compromise. Stop interacting, report the workplace event and check whether anything was downloaded or approved. Choose further actions with the responsible owner.",{"question":103,"answer":104},"I changed the password. Is the incident finished?","Not necessarily: sessions, application consent, authentication methods, device exposure and payments may need separate review according to what occurred.",{"question":106,"answer":107},"Should I pay someone who messages me promising recovery?","Do not treat unsolicited recovery offers as a trusted route. Use your genuine provider, bank and established workplace contacts; no outcome is guaranteed by this guide.",[109,112,115,118,121,123],{"path":110,"label":111},"\u002Fblog\u002Fmicrosoft-365-account-compromise","Follow the Microsoft 365 account-response guide",{"path":113,"label":114},"\u002Fblog\u002Fincident-response-small-business","Use defined incident owners and escalation routes",{"path":116,"label":117},"\u002Fblog\u002Fidentify-phishing-message","Check future messages before taking action",{"path":119,"label":120},"\u002Fblog\u002Fqr-phishing-check","Separate QR scanning from later actions",{"path":14,"label":122},"Discuss account access and authentication work",{"path":13,"label":124},"Describe an active technical incident",[126,127],{"label":32,"url":33},{"label":72,"url":73},{"title":129,"description":130,"button":131,"type":132},"Describe the account or technical incident clearly","Tell us which system was affected and what was done, without sending passwords or live access codes. For financial exposure, contact the genuine bank promptly.","Describe the technical incident","fix",[134,143,151,159],{"id":135,"path":136,"title":137,"description":138,"category":139,"artwork":140,"order":141,"publishedOn":142},"P087","\u002Fblog\u002Fdeepfake-payment-call","Deepfake voice payment scam prevention for business teams","Verify urgent voice and video payment requests through trusted contacts and approval rules. Build a process that does not depend on spotting fake audio.","access","support",32,"2026-07-16",{"id":144,"path":145,"title":146,"description":147,"category":139,"artwork":148,"order":149,"publishedOn":150},"P084","\u002Fblog\u002Fbusiness-phishing-exercise","Phishing training exercise for small business: practice safe reporting","Run a safe tabletop with fictional messages, clear reporting and useful measures. Plan active simulations separately and avoid collecting real credentials.","plan-care",23,"2026-06-14",{"id":152,"path":153,"title":154,"description":155,"category":139,"artwork":156,"order":157,"publishedOn":158},"P094","\u002Fblog\u002Fvendor-access-review","Vendor access review for small business: verify the actual permissions","Review supplier accounts, roles, tokens, hosting and recovery access. Tie each permission to a task, owner, expiry decision and controlled acceptance check.","plan-plus",19,"2026-05-29",{"id":160,"path":119,"title":161,"description":162,"category":139,"artwork":163,"order":164,"publishedOn":165},"P086","How to spot QR code phishing without opening the destination","Assess unexpected QR codes, trusted destinations and cross-device risks. Separate scanning, opening, signing in and granting access when reporting an event.","integrations",37,"2026-07-30",[],null,{"path":169,"label":170},"\u002Fresources","Website security resources and templates",{"path":172,"label":173},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058253]