If you clicked a phishing link or typed your password into a fake page, act now – the first 15 minutes decide how bad this gets. Do these steps in this exact order.
The first 15 minutes
- Disconnect the machine. Turn off Wi-Fi or unplug the network cable. Don’t power it off – just take it off the network.
- From a different device (your phone on mobile data is perfect), change your Microsoft 365 password. Email first, always – it’s the master key to everything else.
- Sign out everywhere. At myaccount.microsoft.com, go to Sign-ins and sign out of all sessions. This kicks the attacker out of anything they’ve already opened.
- Tell us straight away – message the helpdesk on WhatsApp (open 24/7) or raise a ticket from the clean device. We’ll review the sign-in logs, check for mail-forwarding rules a phisher may have planted, and audit any app permissions they granted themselves.
- Don’t delete the suspicious email. We need it – the headers and the link tell us what we’re dealing with and who else may have received it.
Once the dust settles
If you reused that password anywhere else, change it there too – attackers try stolen credentials on every big site within hours. Then make sure MFA is on (Adding MFA to your account); with MFA, a stolen password alone gets an attacker nowhere. If you’re seeing signs they got further – strange sent mail, rules you didn’t create – go straight to Think you have been hacked? Do this first.
And for next time: the ten-second habit that catches nearly every fake is in Spot a phishing email before you click.