Next time
Turn a close call into a habit.
Learn the patterns behind the scams so the next one is easier to spot.
Read the phishing field guide → EMERGENCY GUIDE
Clicked a suspicious link?
Take a breath. Then do this.
It happens to careful, intelligent people every day. What matters now is acting quickly. Follow these steps in order.
- RIGHT NOW
Stop, and don't type anything else.
Close the page. If you downloaded a file, don't open it. If something is installing or a stranger has remote control of your computer, disconnect from Wi-Fi or unplug the network cable.
- WITHIN 5 MINUTES
Tell your IT or security contact.
Forward the message or describe what happened. You're not in trouble: the faster they know, the less damage an attacker can do. At home? Skip to the next step.
- WITHIN 15 MINUTES
Change the password you entered, from a different device.
Go directly to the real website or app (not through the link) and change the password. If you use the same password anywhere else, change it there too, starting with your email.
- WITHIN 15 MINUTES
Sign out everywhere and check your MFA.
Most services (Microsoft, Google, Facebook) let you “sign out of all sessions”. Check that no unknown phone or authenticator app was added to your account.
- IF YOU SHARED CARD OR BANK DETAILS
Call your bank immediately.
Use the number on the back of your card. Ask them to block the card and watch for unusual transactions. Banks can often stop a payment if you call fast.
- TODAY
Watch for follow-up and report it.
Expect follow-up scams that use what the attacker learned. Report the message: in Albania to the National Cyber Security Authority (AKSK) or the State Police; elsewhere, to your national CERT or police cybercrime unit.
Just clicked, but didn't type anything? The risk is usually low. Close the page, run your device's security scan, and tell IT so they can block the site for everyone else.
For IT teams: reset the user's credentials, revoke active sessions and tokens, check mailbox rules for auto-forwarding (a favourite attacker trick), search for the same message in other mailboxes, and block the sender and domain.
FOR ORGANIZATIONS
Make reporting the reflex,
not the exception.
Teams that practice with simulations report real attacks faster, and that speed is what limits the damage.