User Actions for Suspected Phishing Attack

1. Stay calm, take a deep breath.
2. Take pictures of your screen using your smartphone showing the things you noticed: the phishing message, the link if you opened it, the sender information.
3. Take notes about the problem(s) using the voice memo app on your smartphone or pen-and-paper. Every little bit helps! Document the following:
   1. What did you notice?
   2. Why did you think it was a problem?
   3. What were you doing at the time you detected it?
   4. When did it first occur, and how often since?
   5. Where were you when it happened, and on what network? (office/home/shop, wired/wireless, with/without VPN, )

What systems are you using? (operating system, hostname, etc.)

5. What account were you using?
6. What data do you typically access?
7. Who else have you contacted about this incident, and what did you tell them?

4. Contact the help desk and be as helpful as possible.

Be patient: the response may be disruptive, but you are protecting your team and the organization! Thank you.