If you entered a password, change it right away from a different, trusted device, and make sure multi-factor authentication is on. If you opened an attachment or downloaded something, disconnect the computer from the network and have it checked. Then tell your IT contact so they can check for other affected accounts.
Common causes
Credential phishing
Fake Microsoft 365, bank, or shipping login pages steal usernames and passwords.
Malicious attachments
Files that install malware when opened or when macros are enabled.
MFA fatigue and fake prompts
Attackers trigger repeated sign-in prompts hoping you'll approve one.
Business email compromise
Attackers use a stolen mailbox to send fake invoices or payment change requests.
How to fix it, step by step
- 1
Change the password from another device
Use a phone or another trusted computer to change the password for the affected account.
- 2
Sign out all sessions
In Microsoft 365, an administrator can revoke all active sessions so the attacker is logged out.
- 3
Turn on multi-factor authentication
If it isn't on already, enable it immediately.
- 4
Disconnect if you downloaded something
Unplug the network cable or turn off WiFi, and don't use the computer until it's checked.
- 5
Check for inbox rules and forwarding
Attackers often add rules to hide replies or forward your email.
- 6
Warn your contacts if needed
If emails were sent from your account, let customers know not to act on them.
When to call a technician
Call right away — especially if money, invoices, or payment details are involved. We secure the account, check for rules and sign-ins from unusual locations, scan the computer, and help you notify anyone affected.
On-site support across Orange County · see our IT support, managed IT, Microsoft 365 support and cybersecurity services.
Frequently asked questions
Is just clicking a phishing link dangerous?
Sometimes. The biggest risks come from entering credentials or downloading files, but it's always worth reporting.
Will changing my password be enough?
It's the first step. Active sessions also need to be revoked, and MFA should be on, because attackers may already be signed in.
How can we train staff to spot phishing?
Short regular training and simulated phishing tests make a big difference, along with email filtering and MFA.