What to Do When a Staff Member Clicks a Phishing Link

What Did They Do After the Click?

Ask calmly, and ask soon. A click on its own is a far smaller problem than a typed password. Even the UK National Cyber Security Centre's advice to people who clicked starts with "don't panic."

Why Isn't Resetting the Password Enough?

A new password stops the next sign-in. It doesn't end the sessions the attacker already has. Microsoft says plainly that "App passwords aren't automatically revoked when you reset the password." Attackers also set inbox rules that forward mail out or hide replies, and those stay too.

K-12 admins in a recent r/k12sysadmin thread said the same from experience. One wrote, "A lot of the phishing emails use the user/pass provided to create an OAUTH token, so they can still login after you change the password. You gotta revoke all sign-ins."

What Are the First-Hour Steps in Google Workspace?

These steps work in every Google Workspace for Education edition, Education Fundamentals included.

1. Suspend the user. Find them in the Admin console under Directory > Users. Suspending resets their sign-in cookies and OAuth tokens, so every session ends.
2. Read what happened. Open Reporting > Audit and investigation > User log events. It shows sign-ins and any change to the password, recovery details, or 2-Step Verification. Look for sign-ins from places you don't expect, then check what else that IP address did.
3. Reset the password. Choose Reset password on the user and let Google generate one. The user sets their own at the next sign-in.
4. Remove what the attacker added. On the user's Security panel, remove unknown apps under Connected applications. Revoke anything under Application-specific password. Under 2-Step Verification, generate new backup codes, which turns the old ones off. Remove any security key or passkey the staff member doesn't recognize.
5. Check filters and forwarding. Use GAM, a free command-line tool, or sit with the staff member and open their Gmail settings together. Look for new filters, forwarding addresses, delegates, vacation replies, and send-as addresses.
6. Restore the account. Unsuspend it once it's clean, and have the staff member sign in with the new password.

Connected app removal lasts only until the user signs in to that app again. To keep an app out, block it with app access controls.

What Are the First-Hour Steps in Microsoft 365?

These steps don't need a Defender license.

1. Disable the account. In the Microsoft Entra admin center, open Entra ID > Users > All users and pick the user. Under Account status, choose Edit, then clear Account enabled. If you can't disable it, reset the password instead.
2. Revoke sessions. On the user's Overview page, choose Revoke sessions.
3. Reset sign-in methods. Under Authentication methods, choose Require re-register MFA. Then delete their app passwords: under Entra ID > Users > Per-user MFA, select the user, choose Manage user settings, and check Delete all existing app passwords.
4. Remove apps they didn't add. Open Entra ID > Enterprise apps > All applications and look for any app the staff member doesn't recognize. Turn off Enabled for users to sign-in in its Properties, or delete it.
5. Check inbox rules and forwarding. In Exchange Online PowerShell, run Get-InboxRule -Mailbox <user> -IncludeHidden and remove any rule that forwards, deletes, or moves mail. Then run Get-Mailbox <user> | Format-List Forwarding* to find forwarding set on the mailbox itself.
6. Read the sign-in logs. Open Entra ID > Monitoring & health > Sign-in logs. Check non-interactive sign-ins too.

When the account is clean, reset the password and turn the account back on.

How Do You Find Everyone Else Who Got the Email?

The phish rarely lands in one inbox. And once an attacker has an account, they often mail its contacts from it. As one admin put it, "your employee is their patient zero." Check the account's Sent folder for anything the staff member didn't write.

In Google Workspace, the security investigation tool finds every copy by subject and deletes it. Open Security > Security center > Investigation tool, choose Gmail log events, then Actions > Delete messages. Gmail log events in the investigation tool come with Education Plus. On other editions, each copy comes out one inbox at a time, or by a GAM script.

In Microsoft 365, Real-time detections in Defender for Office 365 Plan 1 finds every copy. Removing them from there takes Plan 2: Threat Explorer has a Take action button, which needs the Search and Purge role. Without Plan 2, search for the email in Microsoft Purview eDiscovery and purge it in PowerShell. Without E5, that removes up to 10 items per mailbox at a time.

Sometimes the compromised account belongs to another school. In its first eight weeks with Tartan, Monroe School District found that nine malicious emails came from compromised accounts at eight other school districts. Those arrive from a real school address, so filters often let them through.

Could This Turn Into Payroll or Invoice Fraud?

Yes, and schools are a known target. An FBI alert on payroll diversion named education among the institutions most affected. The attacker signs in to the payroll portal with the stolen password and changes the bank account. Then a rule stops the employee from seeing the alert about it.

Invoices are the other route. One admin in the thread described attackers taking a real invoice from the mailbox. They later sent it to accounts payable from a lookalike domain, with new bank details.

• Call payroll today and ask them to hold any bank change for this staff member.
• Warn your business office to confirm any new payment details by phone.
• If money moved, file at ic3.gov and write "payroll diversion" in the complaint, as the FBI asks.

Who Do You Tell?

Tell your superintendent or head of school, and your business office. If the account could reach student or staff records, bring in your school's legal counsel and follow your incident plan. The US Department of Education's data breach response checklist is a useful starting point. If you have cyber insurance, read the policy's notice terms.

Keep an incident log from the first minute: what you saw, what you did, and when. A district admin in the thread put the reason well: "If things spiral out of control, especially if it becomes a legal matter, you will be glad you have this."

What Do You Say to the Staff Member?

Thank them for telling you. In the same thread, one teacher had clicked the day before and told no one. The NCSC puts it simply: "Users who fear reprisals will not report mistakes promptly, if at all."

At Tartan, we teach good habits and don't shame people. Ask them to change the same password on any other account where they used it, like personal email or a bank. Then help them see what gave the email away. Short phishing simulations build that habit before the next real one.

How Fast Do Staff Report a Phishing Email?

Faster than you might think, when reporting takes one click. At the 180 schools in our data, the median email got its first staff report 38.9 minutes after delivery. Emails that got removed came out a median of 5.7 minutes after that report.

Tartan App Shield puts a report button in Gmail and Outlook. Threat Manager scores each report and alerts IT. From there you can delete the email from every mailbox at once, along with everything from that sender or domain. On Education Fundamentals and Standard, that adds the delete-from-every-inbox step the Admin console doesn't offer, for any email a staff member reports. At Monroe, two staff reports were enough to pull a malicious document-share email from all 25 mailboxes it reached.

What Should You Change After the Incident?

• Turn off automatic forwarding. In Google, open Apps > Google Workspace > Gmail > End User Access > Automatic forwarding. It's on by default. In Microsoft, set Automatic forwarding rules to Off in the outbound anti-spam policy.
• Watch the alerts you already have. Google's alert center, in every education edition, flags user-reported phishing, leaked passwords, and suspicious logins.
• Practice with your staff. Our guide to cybersecurity training for schools shows which lures school staff click most.