2 min read
What to do if you clicked
The first steps after someone at a small business opens a suspicious link or types a password.
Clicking is common. Hiding it is what turns a small mistake into a forwarded mailbox or a paid invoice.
If the page is still open and it asked you to sign in, close it. Do not finish the form. Disconnect from Wi-Fi if the computer starts downloading something you did not ask for, and tell the owner before you reboot a dozen times.
If you typed a password, change it from the real site. Type the address yourself or use a bookmark. Then change any other account that used the same password. Turn on multi-factor authentication if it was off. In the account settings, sign out other sessions if that option exists.
If you sent a code, approved a prompt, or paid someone, call the owner and the bank the same day. Write down the time, what you clicked, and what you typed. A short note is enough.
Tell the truth about what happened. The owner needs it to decide whether to call the insurer, the bank, or a customer. You are not the first person to click, and you will not be the last.
If the page said it was a Gradefort Academy exercise, you do not need to change a password. Mark the lesson read, report it with the button on that page, and remember the cue that got you. That cue is the lesson.