You clicked, the page looked wrong, and now you are wondering whether to tell somebody. Tell the person responsible for your business technology. An early report gives the team a better chance to assess what happened than a quiet afternoon spent hoping nothing changes.
Not every click leads to the same result. Opening a page, typing a password, approving a sign-in, downloading a file, and running that file are different events. The details guide the response.
Stop interacting and report the facts
Do not keep clicking to investigate. Note the approximate time, the account involved, and what the page asked you to do. Use the organization’s approved reporting route, preferably from a separate trusted device if compromise is suspected.
Keep the original message available for the response team. Do not send it around the office asking everyone to test it. Avoid putting passwords, authentication codes, or sensitive records into a support description.
If you entered credentials, use a known route
Contact IT promptly and explain which account was involved. From a trusted device and an independently verified service address, follow their recovery instructions. That may include replacing the password and reviewing active sessions and account changes.
Changing a password is not proof that an incident is resolved. The administrator may need to investigate access, forwarding, or activity after the suspected exposure. Report whether you reused the credential elsewhere without sharing the credential itself.
If you opened a file, get help with the device
Tell IT whether the file was only downloaded or actually opened or run. Follow the response team’s containment instructions. Do not repeatedly restart, install random cleanup tools, or attach backup drives while trying to fix the problem alone.
The FTC’s phishing guidance recommends security-software checks when a suspicious download may have installed malware. In a managed business environment, coordinate that work with the person handling the incident so useful evidence and necessary containment are not lost.
If money or identity information was involved, escalate
Tell the authorized business owner immediately. Use a known contact route for the relevant financial institution or service. The appropriate response depends on what was disclosed and what action actually occurred; do not wait for a routine technical review to report a suspected fraudulent transfer.
The FTC links to IdentityTheft.gov for guidance when personal identity or financial information has been exposed. Keep the response factual and avoid making public claims about the incident before it is understood.
Make the next report easier
Once the immediate issue is handled, improve the reporting process. Staff should know whom to contact and should not expect punishment for raising an honest concern.
The useful question is not “How could you click that?” It is “What happened, what do we need to protect, and who is taking the next step?” That question gets the business moving toward a response.