Cybersecurity · Beginner level

Beginner level · Module 2: Phishing and Social Engineering Awareness · Lesson 3 of 3

Reporting and Responding to Phishing

Know what to do if you receive — or fall for — a phishing message.

In this lesson you will

  • Report phishing correctly
  • Take the right steps after clicking a suspicious link

Key concepts

reportingdo not replychanging passwordswarning others

The lesson

If you receive phishing, do not reply, click or forward it to colleagues as a warning with the link intact. Report it using the email 'report phishing' option or to your IT contact.

If you clicked or entered a password, act quickly: change the password from a trusted device, check MFA is on, sign out other sessions and tell IT or the account provider.

Reporting without blame helps everyone: the faster a mistake is reported, the less damage it does.

Step by step

  1. Find the 'report phishing' option in your email app.
  2. Write the steps to take after clicking a bad link.
  3. Practise changing a password and signing out other sessions.
  4. Draft a short warning message without dangerous links.

Practice activity

Write a one-page 'I think I clicked a phishing link' guide for colleagues.

Expected result: A clear guide with immediate steps and contacts.

Check your understanding

  1. What is the first thing to do if you entered your password on a fake page?

    Show answer

    Change the password from a trusted device and check MFA.

  2. Why should reporting be blame-free?

    Show answer

    People report faster, which limits the damage.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.