Someone clicked a link in an email that turned out to be wrong, and nobody is sure what happened next.

Sort it by what came after the click

The FTC splits the cases the same way: either information was given to a scammer, or a link or attachment may have downloaded harmful software. Ask the person who clicked, in these words, and write the answers down with the time.

• Only opened the page, then closed it. Nothing typed, nothing downloaded, nothing approved.
• A page asked for an email address and password, and they typed them. This is the most common version, and the one that needs the most attention.
• The page asked for a code or a phone approval, and they gave it. The person on the other end now has a signed-in session, not just a password.
• A file downloaded or opened. A document, a zip, or a program that ran.
• They aren’t sure. Treat it as the next row up until a person has looked at the history.

The first hour, in this order

1. Ask the person to stop using that computer for email and not to close the browser tab until you have written down the web address in the address bar. Photograph it.
2. If a password was typed, change it from a different computer or a phone that did not open the link. Do not send the new password by email.
3. Ask whoever administers Microsoft 365 to end the person’s active sessions. Microsoft’s documentation says a stolen token can be replayed “even if that user has satisfied multifactor authentication,” so a password change alone does not end a session that already exists. Microsoft’s administrator page for the user has a Revoke sessions button for this.
4. If a file was opened, leave the computer on and take it off the network, then follow the evidence page before anyone cleans it.
5. Report the message through the Report button in Outlook, or forward it to whoever handles mail. Do not delete it first.

How long a session can outlast a password change

Microsoft says access tokens last one hour by default, and applications that use their own session cookies end access on their own schedule, which Microsoft cannot cut off directly. That is the reason the order above matters: a changed password stops the next sign-in, and ending sessions deals with the one already open. Plan on doing both, and write down the time you did each.

What to check in the mailbox afterwards

Microsoft’s list of symptoms of a compromised mailbox includes places people forget to look. The forwarding and rule checks have their own page, linked below. These are the others:

• Sent Items and Deleted Items. Messages you don’t recognize in Sent Items, or mail in Deleted Items that no one deleted.
• Rules that move mail into the Notes, Junk Email, or RSS Subscriptions folders. Those are folders almost nobody opens.
• The person’s own contact card in the company address book: name, telephone number, or postal code that changed.
• The email signature. Microsoft lists a fake banking or pharmacy signature as one sign.
• Frequent password changes or lockouts the person didn’t cause.

Who else received it

One click usually means more than one recipient. Ask your administrator to run a message trace on the sender address and subject, and to look in the account’s audit log starting from just before the click, without filtering for specific activity on the first search. That is Microsoft’s own instruction for investigating a compromised account. Then tell the other recipients that the message is not to be opened, in a message that does not repeat the link.

What these checks can and can’t tell you

A clean Sent Items folder and no odd rules cover what you looked at on that day. They don’t show whether someone only read mail, and they don’t show a session that ended before you looked. If a password was typed, the account has to be treated as known to someone else from the time of the click, whatever the folders show.

When we look at this with you, we read the sign-in history, the audit log, and the mailbox rules, and tell you what we found and what we didn’t, with the dates. A person reads the result.

A link that was clicked cannot be unclicked, but what it was used for can be traced, and that starts with the time on your notes.

Related

• A Forwarding Rule in Your Email You Didn’t Create
• Keeping Evidence Before You Clean Up a Computer
• Business Email Hacked: Take the Account Back in Order
• Who to Tell After a Security Incident, and in What Order

Sources

• FTC: How to Recognize and Avoid Phishing Scams
• CISA: Avoiding Social Engineering and Phishing Attacks
• Microsoft Learn: Respond to a compromised email account in Microsoft 365
• Microsoft Learn: Token theft playbook
• Microsoft Learn: Revoke user access in an emergency